This part introduces a XSS vulnerability.

Please change `badgeState.iconURL` to `badgeState.iconURL.replace(/"/g, '&quot;')` to resolve the problem.