Merge pull request matplotlib#30146 from meeseeksmachine/auto-backport-of-pr-30144-on-v3.10.x

Backport PR matplotlib#30144 on branch v3.10.x (js: Fix externally-controlled format strings)

Author: QuLogic

lib/matplotlib/backends/web_backend/js/mpl.js

@@ -575,19 +575,21 @@ mpl.figure.prototype._make_on_message_function = function (fig) {
             var callback = fig['handle_' + msg_type];
         } catch (e) {
             console.log(
-                "No handler for the '" + msg_type + "' message type: ",
+                "No handler for the '%s' message type: ",
+                msg_type,
                 msg
             );
             return;
         }
 
         if (callback) {
             try {
-                // console.log("Handling '" + msg_type + "' message: ", msg);
+                // console.log("Handling '%s' message: ", msg_type, msg);
                 callback(fig, msg);
             } catch (e) {
                 console.log(
-                    "Exception inside the 'handler_" + msg_type + "' callback:",
+                    "Exception inside the 'handler_%s' callback:",
+                    msg_type,
                     e,
                     e.stack,
                     msg