[MaStr]

Fixes CodeQL alert #59 (js/xss-through-dom) in docs/assets/js/peak-shaving-charts.js.

When a scenario CSV failed to load, the scenario name and err.message were concatenated into innerHTML. A small showError() helper now builds the <p class="ps-error"> element and sets the message via textContent. The summary loader had the same pattern and uses the helper too.

Rendering is unchanged; only the error text is no longer interpreted as HTML.

🤖 Generated with Claude Code

[Copilot]

🟢 Approval recommended

Both err.message error paths are now rendered as text via textContent, the remaining innerHTML uses are static or trusted CSV data, and the ps-error class remains defined, making this a correct and self-contained security fix.

No open issues 🎉

What changed in this PR

This PR fixes a CodeQL js/xss-through-dom finding in the documentation's peak-shaving chart script. Previously, when a scenario CSV or the summary CSV failed to load, the catch handlers concatenated the scenario name and err.message directly into container.innerHTML, meaning the error text was interpreted as HTML. The PR introduces a small showError() helper that builds the <p class="ps-error"> element and assigns the message via textContent, so the error text can no longer be parsed as markup. Both error paths now use the helper, and the visible rendering is unchanged.

Changes:

• Added a showError(container, text) helper that creates a <p class="ps-error">, sets the message with textContent, and swaps content via replaceChildren.
• Replaced the two innerHTML-based error handlers (scenario load failure and summary load failure) with calls to showError().

File	Description
docs/​assets/​js/​peak-shaving-charts.js	Adds a showError() helper using textContent and routes both CSV-load error handlers through it to prevent HTML injection via err.message.

_{Review effort: Balanced}