Set element text instead of HTML where possible (#1956)

src/sql/base/browser/ui/modal/dialogHelper.ts

@@ -33,7 +33,7 @@ export function appendRowLink(container: Builder, label: string, labelClass: str
 	container.element('tr', {}, (rowContainer) => {
 		rowContainer.element('td', { class: labelClass }, (labelCellContainer) => {
 			labelCellContainer.div({}, (labelContainer) => {
-				labelContainer.innerHtml(label);
+				labelContainer.text(label);
 			});
 		});
 		rowContainer.element('td', { class: cellContainerClass }, (inputCellContainer) => {

src/sql/base/browser/ui/modal/optionsDialog.ts

@@ -150,8 +150,8 @@ export class OptionsDialog extends Modal {
 
 	private onOptionLinkClicked(optionName: string): void {
 		var option = this._optionElements[optionName].option;
-		this._optionTitle.innerHtml(option.displayName);
-		this._optionDescription.innerHtml(option.description);
+		this._optionTitle.text(option.displayName);
+		this._optionDescription.text(option.description);
 	}
 
 	private fillInOptions(container: Builder, options: sqlops.ServiceOption[]): void {

src/sql/base/browser/ui/panel/tabHeader.component.ts

@@ -62,7 +62,7 @@ export class TabHeaderComponent extends Disposable implements AfterContentInit,
 			tabLabelcontainer.classList.add(this.tab.iconClass);
 		} else {
 			tabLabelcontainer.className = 'tabLabel';
-			tabLabelcontainer.innerHTML = this.tab.title;
+			tabLabelcontainer.textContent = this.tab.title;
 		}
 		tabLabelcontainer.title = this.tab.title;
 	}

src/sql/base/browser/ui/table/plugins/headerFilter.plugin.ts

@@ -6,6 +6,7 @@ import { mixin } from 'vs/base/common/objects';
 import { SlickGrid } from 'angular2-slickgrid';
 import { Button } from '../../button/button';
 import { attachButtonStyler } from 'sql/common/theme/styler';
+import { escape } from 'sql/base/common/strings';
 import { IThemeService } from 'vs/platform/theme/common/themeService';
 
 export class HeaderFilter {
@@ -174,7 +175,7 @@ export class HeaderFilter {
 			if (filterItems[i] && filterItems[i].indexOf('Error:') < 0) {
 				filterOptions += '<label><input type="checkbox" value="' + i + '"'
 				+ (filtered ? ' checked="checked"' : '')
-				+ '/>' + filterItems[i] + '</label>';
+				+ '/>' + escape(filterItems[i]) + '</label>';
 			}
 		}
 		let $filter = $('<div class="filter">')

src/sql/base/browser/ui/table/plugins/rowDetailView.ts

@@ -1,5 +1,6 @@
 // Adopted and converted to typescript from https://github.com/6pac/SlickGrid/blob/master/plugins/slick.rowdetailview.js
 // heavily modified
+import { escape } from 'sql/base/common/strings';
 import { mixin } from 'vs/base/common/objects';
 import * as nls from 'vs/nls';
 
@@ -354,7 +355,7 @@ export class RowDetailView {
 			html.push("style='height:", dataContext._height, "px;"); //set total height of padding
 			html.push("top:", rowHeight, "px'>");             //shift detail below 1st row
 			html.push("<div id='detailViewContainer_", dataContext.id, "'  class='detail-container' style='max-height:" + (dataContext._height - rowHeight + bottomMargin) + "px'>"); //sub ctr for custom styling
-			html.push("<div id='innerDetailView_", dataContext.id, "'>", dataContext._detailContent, "</div></div>");
+			html.push("<div id='innerDetailView_", dataContext.id, "'>", escape(dataContext._detailContent), "</div></div>");
 			//&omit a final closing detail container </div> that would come next
 
 			return html.join('');

src/sql/base/browser/ui/taskbar/taskbar.ts

@@ -82,7 +82,7 @@ export class Taskbar {
 	public static createTaskbarText(inputText: string): HTMLElement {
 		let element = document.createElement('div');
 		element.className = 'taskbarTextSeparator';
-		element.innerHTML = inputText;
+		element.textContent = inputText;
 		return element;
 	}