Potential fix for code scanning alert no. 2: Client-side cross-site scripting

[gitricko]

Potential fix for https://github.com/gitricko/hermes-vscode/security/code-scanning/2

Best fix: stop using innerHTML for dynamic todo item rows and build the DOM with document.createElement, classList, and textContent. This preserves behavior while removing the XSS sink path.

In src/webview/renderers.ts, update renderTodoOverlay (lines around 87–99):

• Keep the early return and completed calculation.
• Replace the items HTML string construction and final container.innerHTML = ...${items} with:
  • container.innerHTML only for the static header (or create header element too),
  • per-todo element creation via DOM APIs.
• Validate status before using it as a class token (allow only known statuses from TODO_ICONS; fallback to 'pending').
• Set todo text with textContent (not sanitized HTML), since this is plain text display.

No import changes are required.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[Copilot]

Pull request overview

This PR addresses a code scanning alert for client-side XSS in renderTodoOverlay by replacing string-based innerHTML construction of todo items with safe DOM API calls (createElement, classList, textContent). Status values are also validated against the known TODO_ICONS keys before being used as a CSS class token.

Changes:

• Replace innerHTML interpolation of per-todo markup with document.createElement + textContent.
• Validate t.status against TODO_ICONS keys, falling back to 'pending'.
• Retain innerHTML only for the static header element.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.