Files
TORCH/dashboard/domUtils.js
T
google-labs-jules[bot]andPR0M3TH3AN b92f0efd38 feat(security): migrate dashboard innerHTML to safe DOM APIs
- Replace innerHTML with document.createElement and replaceChildren in dashboard/index.html
- Add dashboard/domUtils.js for safe HTML escaping and element creation
- Add context, decisions, and test logs
- Update daily task logs

Co-authored-by: PR0M3TH3AN <[email protected]>
2026-02-14 23:05:24 +00:00

31 lines
870 B
JavaScript

// DOM utility functions for safe rendering
/**
* Escapes unsafe HTML characters in a string.
* @param {string} unsafe The string to escape.
* @returns {string} The escaped string.
*/
export function escapeHtml(unsafe) {
if (unsafe == null) return '';
return String(unsafe)
.replace(/&/g, "&amp;")
.replace(/</g, "&lt;")
.replace(/>/g, "&gt;")
.replace(/"/g, "&quot;")
.replace(/'/g, "&#039;");
}
/**
* Creates an element with optional class and text content.
* @param {string} tag The tag name.
* @param {string} [className] The class name(s).
* @param {string} [text] The text content.
* @returns {HTMLElement} The created element.
*/
export function createElement(tag, className, text) {
const el = document.createElement(tag);
if (className) el.className = className;
if (text != null) el.textContent = text;
return el;
}