Potential fix for code scanning alert no. 26: Client-side cross-site scripting

[rajbos]

Potential fix for https://github.com/rajbos/github-copilot-token-usage/security/code-scanning/26

In general, to fix DOM-based XSS you must ensure that any data coming from untrusted sources is either (1) safely encoded/escaped for the exact context where it is injected (HTML body, attribute, URL, etc.), or (2) inserted using DOM APIs (textContent, setAttribute, etc.) rather than string concatenation and innerHTML/insertAdjacentHTML.

For this specific code, the simplest fix that preserves existing functionality is:

• Continue using escapeHtml for text/HTML contexts.
• Ensure the numeric/session count (sf.count) is safely rendered as plain text by avoiding direct HTML string interpolation.
• Avoid using insertAdjacentHTML / outerHTML with a large HTML string that contains interpolated untrusted data. Instead, build the DOM nodes programmatically:
  • Create the container, table, and row elements with document.createElement.
  • Set text via textContent and attributes via setAttribute.
  • Append the composed node to the DOM using appendChild/insertBefore/replaceWith.

Concretely, within src/webview/diagnostics/main.ts around lines 915–962:

• Remove the string-building logic for sessionFilesHtml.
• Replace it with code that:
  • Creates a <div class="session-folders-table"> container and its child <h4> and <table> elements.
  • Iterates sorted and for each sf creates a <tr> with <td> cells:
    • Folder cell: title set via setAttribute('title', escapeHtml(sf.dir)) or, more robustly, set the raw string and rely on escapeHtml only if needed; textContent set to the display string.
    • Editor badge: create <span class="editor-badge"> and set textContent to editorName.
    • Count: set textContent to String(sf.count).
    • Open directory link: href="#", class="reveal-link", and data-path via setAttribute('data-path', sf.dir) or encodeURIComponent(sf.dir) if required by the extension.
  • Either replace an existing .session-folders-table via existingTable.replaceWith(container) or insert the new container after .report-content with insertBefore on parentNode.

This keeps the rendered structure identical (same classes and attributes) but removes the XSS risk by no longer passing tainted data through insertAdjacentHTML/outerHTML.

---

Suggested fixes powered by Copilot Autofix. Review carefully before merging.