Replace innerHTML with innerText

For any content where the user can potentially influence the content.

Author: vidartf

packages/labextension/src/widget.ts

@@ -241,9 +241,11 @@ namespace Private {
         <button class="nbdime-export" style="display: none">Export diff</button>
       </div>
       <div class=nbdime-header-banner>
-        <span class="nbdime-header-base">${baseLabel}</span>
-        <span class="nbdime-header-remote">${remoteLabel}</span>
+        <span class="nbdime-header-base"></span>
+        <span class="nbdime-header-remote"></span>
       </div>`;
+    (node.getElementsByClassName("nbdime-header-base")[0] as HTMLSpanElement).innerText = baseLabel;
+    (node.getElementsByClassName("nbdime-header-remote")[0] as HTMLSpanElement).innerText = remoteLabel;
 
     return new Widget({node});
   }

packages/nbdime/src/common/util.ts

@@ -298,7 +298,7 @@ function buildSelect(options: string[], select?: HTMLSelectElement): HTMLSelectE
   }
   for (let option of options) {
     let opt = document.createElement('option');
-    opt.value = opt.innerHTML = option;
+    opt.value = opt.innerText = option;
     select.appendChild(opt);
   }
   return select;

packages/webapp/src/app/diff.ts

@@ -182,11 +182,14 @@ function onDiffRequestCompleted(data: any) {
  */
 function onDiffRequestFailed(response: string) {
   console.log('Diff request failed.');
-  let root = document.getElementById('nbdime-root');
+  const root = document.getElementById('nbdime-root');
   if (!root) {
     throw new Error('Missing root element "nbidme-root"');
   }
-  root.innerHTML = '<pre>' + response + '</pre>';
+  const pre = document.createElement('pre');
+  pre.innerText = response;
+  root.innerHTML = '';
+  root.appendChild(pre);
   diffWidget = null;
   toggleSpinner(false);
 }

packages/webapp/src/app/merge.ts

@@ -177,7 +177,10 @@ function onMergeRequestFailed(response: string) {
   if (!root) {
     throw new Error('Missing root element "nbidme-root"');
   }
-  root.innerHTML = '<pre>' + response + '</pre>';
+  const pre = document.createElement('pre');
+  pre.innerText = response;
+  root.innerHTML = '';
+  root.appendChild(pre);
   mergeWidget = null;
   toggleSpinner(false);
 }