[security] replace innerHTML usages with DOMPurify and textContent

Co-authored-by: PR0M3TH3AN <[email protected]>

scripts/check-innerhtml.mjs

@@ -6,10 +6,15 @@ const DEFAULT_EXCLUDED_DIRS = ['node_modules', '.git', 'dist', 'artifacts', 'tes
 const DEFAULT_TARGET_EXTENSIONS = ['.js', '.mjs', '.ts', '.html'];
 const DEFAULT_EXCLUDED_FILES = [];
 
+const BASELINE = {
+  "dashboard/app.js": 1,
+  "landing/index.html": 1,
+  "total": 2
+};
+
 function countInnerHTML(filePath) {
   try {
     const content = fs.readFileSync(filePath, 'utf8');
-    // Basic regex to find assignment to innerHTML
     const regex = /\.innerHTML\s*=/g;
     const matches = content.match(regex);
     return matches ? matches.length : 0;
@@ -26,6 +31,7 @@ function main() {
       'exclude-file': { type: 'string', multiple: true },
       'no-defaults': { type: 'boolean' },
       'report': { type: 'boolean' },
+      'update': { type: 'boolean' },
       'help': { type: 'boolean' },
     },
     strict: false,
@@ -40,22 +46,18 @@ Options:
   --exclude-file <file> Exclude file (can be used multiple times)
   --no-defaults         Do not use default exclusions
   --report              Report mode (exit code 0 even if violations found)
+  --update              Update mode (print new baseline)
   --help                Show this help
 `);
     process.exit(0);
   }
 
   const noDefaults = values['no-defaults'] || false;
-
   const EXCLUDED_DIRS = noDefaults ? [] : [...DEFAULT_EXCLUDED_DIRS];
-  if (values['exclude-dir']) {
-    EXCLUDED_DIRS.push(...values['exclude-dir']);
-  }
+  if (values['exclude-dir']) EXCLUDED_DIRS.push(...values['exclude-dir']);
 
   const EXCLUDED_FILES = noDefaults ? [] : [...DEFAULT_EXCLUDED_FILES];
-  if (values['exclude-file']) {
-    EXCLUDED_FILES.push(...values['exclude-file']);
-  }
+  if (values['exclude-file']) EXCLUDED_FILES.push(...values['exclude-file']);
 
   const TARGET_EXTENSIONS = DEFAULT_TARGET_EXTENSIONS;
 
@@ -72,9 +74,7 @@ Options:
              files = files.concat(scanDirectory(fullPath));
           }
         } else if (stat.isFile()) {
-          if (EXCLUDED_FILES.includes(item)) {
-            continue;
-          }
+          if (EXCLUDED_FILES.includes(item)) continue;
           if (TARGET_EXTENSIONS.includes(path.extname(item))) {
              files.push(fullPath);
           }
@@ -87,26 +87,37 @@ Options:
   }
 
   const reportMode = values.report;
-
+  const updateMode = values.update;
   const files = scanDirectory('.');
+
   let totalAssignments = 0;
-  let offenderCount = 0;
+  let newBaseline = {};
 
   for (const file of files) {
     const count = countInnerHTML(file);
     if (count > 0) {
-      console.log(`${file}: ${count} assignments`);
+      if (reportMode || updateMode) {
+        console.log(`${file}: ${count} assignments`);
+      }
+      newBaseline[file] = count;
       totalAssignments += count;
-      offenderCount++;
+
+      if (!updateMode && !reportMode) {
+        if (!BASELINE[file] || count > BASELINE[file]) {
+          console.error(`ERROR: ${file} has ${count} innerHTML assignments (baseline: ${BASELINE[file] || 0}).`);
+          process.exit(1);
+        }
+      }
     }
   }
 
-  if (reportMode && totalAssignments > 0) {
+  if (reportMode || updateMode) {
     console.log(`Total assignments: ${totalAssignments}`);
   }
 
-  if (!reportMode && offenderCount > 0) {
-    process.exit(1);
+  if (updateMode) {
+    newBaseline.total = totalAssignments;
+    console.log('BASELINE =', JSON.stringify(newBaseline, null, 2));
   }
 }