Potential fix for code scanning alert no. 4: Client-side cross-site scripting

[gitricko]

Potential fix for https://github.com/gitricko/hermes-vscode/security/code-scanning/4

General fix: avoid writing potentially tainted values through innerHTML unless values are strictly validated/sanitized. Prefer textContent where possible; if HTML is required, ensure all interpolated values are escaped and/or normalized to safe primitives first.

Best fix here without changing existing functionality:

1. In src/webview/menus.ts, normalize token inputs to finite non-negative numbers before formatting in renderTokenDisplay.
2. Escape formatted token strings before embedding into HTML.
3. Keep existing HTML structure/styles intact so UI behavior is unchanged.

Concretely:

• Update renderTokenDisplay(...) to coerce total and size with Number(...), clamp invalid/negative values to 0, then call fmtTok.
• Wrap resulting strings with existing escapeHtml(...) before interpolating into returned HTML.
• No changes needed at call site (innerHTML assignment can remain because output is now safely encoded).

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[Copilot]

Pull request overview

This PR addresses code scanning alert #4 (client-side XSS) by making the status-bar token counter HTML safe to assign via innerHTML, by normalizing token values and HTML-escaping the formatted output.

Changes:

• Normalize total and size to finite, non-negative numbers before formatting.
• Escape the formatted token strings with escapeHtml(...) before interpolating into HTML.
• Keep the existing HTML structure/styles for the token display intact.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.