Backport PR #30144: js: Fix externally-controlled format strings

timhoffm · meeseeksmachine · commit ae159fb12307 · 2025-06-05T10:39:00.000Z
diff --git a/lib/matplotlib/backends/web_backend/js/mpl.js b/lib/matplotlib/backends/web_backend/js/mpl.js
@@ -575,19 +575,21 @@ mpl.figure.prototype._make_on_message_function = function (fig) {
             var callback = fig['handle_' + msg_type];
         } catch (e) {
             console.log(
-                "No handler for the '" + msg_type + "' message type: ",
+                "No handler for the '%s' message type: ",
+                msg_type,
                 msg
             );
             return;
         }
 
         if (callback) {
             try {
-                // console.log("Handling '" + msg_type + "' message: ", msg);
+                // console.log("Handling '%s' message: ", msg_type, msg);
                 callback(fig, msg);
             } catch (e) {
                 console.log(
-                    "Exception inside the 'handler_" + msg_type + "' callback:",
+                    "Exception inside the 'handler_%s' callback:",
+                    msg_type,
                     e,
                     e.stack,
                     msg
