fix(lines): fix potential tooltip XSS vulnerability in lines series

[plainheart]

Brief Information

This pull request is in the type of:

• bug fixing
• new feature
• others

What does this PR do?

Fix potential tooltip XSS vulnerability in lines series.

Comparison

Before	After

Document Info

One of the following should be checked.

• This PR doesn't relate to document changes
• The document should be updated later
• The document changes have been made in apache/echarts-doc#xxx

Misc

Security Checking

• This PR uses security-sensitive Web APIs.

ZRender Changes

• This PR depends on ZRender changes (ecomfe/zrender#xxx).

Related test cases or examples to use the new APIs

See test/tooltip-xss.html

Merging options

• Please squash the commits into a single one when merging.

Other information

[Copilot]

Pull request overview

This PR addresses a potential tooltip XSS injection vector in the lines series by ensuring line item names are rendered via the tooltip markup builder (which HTML-encodes content) rather than being returned as raw HTML.

Changes:

• Update LinesSeriesModel.formatTooltip to always return a nameValue tooltip markup block, using the item name or a fromName > toName fallback and correctly suppressing display when the value is missing/NaN.
• Add a manual repro test page (test/tooltip-xss.html) that attempts to inject an <img onerror=...> payload via data.name.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
src/chart/lines/LinesSeries.ts	Routes line tooltip content through createTooltipMarkup('nameValue', ...) so names are HTML-encoded and values are handled consistently.
test/tooltip-xss.html	Adds a manual test case to verify tooltip rendering does not execute injected HTML/JS from line item names.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[l3tchupkt]

Thank you for the quick fix and review.
I appreciate the prompt response and the addition of the regression test for the issue.

Glad to help improve the security of Apache ECharts.

— @l3tchupkt