Potential fix for code scanning alert no. 25: Client-side cross-site scripting

[rajbos]

Potential fix for https://github.com/rajbos/github-copilot-token-usage/security/code-scanning/25

In general, to fix DOM XSS issues like this, avoid building large chunks of HTML with string concatenation that mix untrusted data and then injecting them via innerHTML, outerHTML, or insertAdjacentHTML. Instead, either (a) use a robust templating or sanitization library to sanitize full HTML strings before injection, or (b) build the DOM structure programmatically with document.createElement, setting text content and attributes via the DOM API so that data is not interpreted as markup.

For this specific code, the best fix without changing the visible behavior is to stop constructing sessionFilesHtml as an HTML string and stop using outerHTML / insertAdjacentHTML. Instead, we will:

• Locate or create the .session-folders-table container element using DOM methods.
• Clear any existing content and then create the <h4>, <table>, <thead>, <tbody>, <tr>, <td>, <span>, and <a> elements using document.createElement.
• For all user-influenced values (sf.dir, display, editorName, sf.count), assign them by:
  • Setting textContent for textual nodes (folder display, editor badge, and count), so HTML is not parsed.
  • Setting title via setAttribute('title', ...) using escapeHtml only if we want to preserve that helper; alternatively, since attributes are not HTML-parsed, we can assign them directly and rely on the browser to treat them as plain text (but we will preserve escapeHtml for minimal behavior change where already used).
  • Using encodeURIComponent(sf.dir) as the value of the data-path attribute via element.setAttribute('data-path', ...) instead of interpolating into an HTML string.
• Replace the existing-table case (existingTable.outerHTML = sessionFilesHtml) with clearing and repopulating the existing element, or by removing and re-inserting a newly constructed element.
• Replace the insert-new-table case (reportContent.insertAdjacentHTML('afterend', sessionFilesHtml)) with insertAdjacentElement('afterend', tableContainerElement).

These changes all occur in src/webview/diagnostics/main.ts around lines 915–962. No extra methods beyond DOM operations are strictly required; we will reuse the existing escapeHtml function that the snippet references (since it’s already used for the titles and cell text). No new imports are needed.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.