avoid html injection

Author: danmarshall

docs/dist/v1/chartifact.host.umd.js

@@ -3653,7 +3653,7 @@ ${guardedJs}
       return;
     }
     let docIndex = 0;
-    host.toolbar.innerHTML = folder.title + `(${folder.docs.length} documents)`;
+    host.toolbar.innerText = folder.title + `(${folder.docs.length} documents)`;
     host.toolbar.style.display = "block";
     const prevBtn = document.createElement("button");
     prevBtn.textContent = "Previous";
@@ -4136,7 +4136,16 @@ ${message}
 ${details}`;
         this.render(markdown, void 0);
       } else {
-        this.appDiv.innerHTML = `<h1>Error</h1><p>${message}</p><p>${details}</p>`;
+        this.appDiv.innerHTML = "";
+        const h1 = document.createElement("h1");
+        h1.textContent = "Error";
+        const pMessage = document.createElement("p");
+        pMessage.textContent = message;
+        const pDetails = document.createElement("p");
+        pDetails.textContent = details;
+        this.appDiv.appendChild(h1);
+        this.appDiv.appendChild(pMessage);
+        this.appDiv.appendChild(pDetails);
       }
     }
     bindTextareaToCompiler() {

packages/host/src/folder.ts

@@ -34,7 +34,7 @@ export function loadFolder(folderUrl: string, folder: Folder, host: Listener) {
 
     let docIndex = 0;
 
-    host.toolbar.innerHTML = folder.title + `(${folder.docs.length} documents)`;
+    host.toolbar.innerText = folder.title + `(${folder.docs.length} documents)`;
     host.toolbar.style.display = 'block';
 
     // Create Previous and Next buttons

packages/host/src/listener.ts

@@ -160,7 +160,17 @@ export class Listener {
       const markdown = `# Error:\n${message}\n\n${details}`;
       this.render(markdown, undefined);
     } else {
-      this.appDiv.innerHTML = `<h1>Error</h1><p>${message}</p><p>${details}</p>`;
+      // Clear previous content
+      this.appDiv.innerHTML = '';
+      const h1 = document.createElement('h1');
+      h1.textContent = 'Error';
+      const pMessage = document.createElement('p');
+      pMessage.textContent = message;
+      const pDetails = document.createElement('p');
+      pDetails.textContent = details;
+      this.appDiv.appendChild(h1);
+      this.appDiv.appendChild(pMessage);
+      this.appDiv.appendChild(pDetails);
     }
   }