From ac236199fc9954acd8df59fceb1fa334cbef74d5 Mon Sep 17 00:00:00 2001
From: Pieter Vander Vennet <pietervdvn@posteo.net>
Date: Thu, 21 Sep 2023 02:35:29 +0200
Subject: [PATCH] Security: use safe 'setAttribute'

---
 src/UI/Base/Link.ts | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/UI/Base/Link.ts b/src/UI/Base/Link.ts
index 693f26218b..f3474f27fd 100644
--- a/src/UI/Base/Link.ts
+++ b/src/UI/Base/Link.ts
@@ -53,17 +53,17 @@ export default class Link extends BaseUIElement {
         }
         const el = document.createElement("a")
         if (typeof this._href === "string") {
-            el.href = this._href
+            el.setAttribute("href", this._href)
         } else {
             this._href.addCallbackAndRun((href) => {
-                el.href = href
+                el.setAttribute("href", href)
             })
         }
         if (this._newTab) {
             el.target = "_blank"
         }
         if (this._download) {
-            el.download = this._download
+            el.setAttribute("download", this._download)
         }
         el.appendChild(embeddedShow)
         return el