Remove use of innerHtml

[psiinon]

Re #620

• zap-hud/src/main/zapHomeFiles/hud/display.js
  • Tricky - we are injecting the HTML ZAP returns - this will require significant rework
• zap-hud/src/main/zapHomeFiles/hud/libraries/alertify.js
  • This is a library outside of our control, but one we would like to replace: Replace alertify.js #306
• zap-hud/src/main/zapHomeFiles/hud/target/inject.js
  • This should be an easy fix

[mozfreddyb]

Re #620
* [ ] zap-hud/src/main/zapHomeFiles/hud/display.js
* Tricky - we are injecting the HTML ZAP returns - this will require significant rework

If you're not against introducing a sanitizer (like DOMPurify), you could change this from
window.open('').document.body.innerHTML = event.data.response;
to
window.open('').document.body.innerHTML = purify(event.data.response);

and have the linter explicitly allow innerHTML as long as it's used in combination with dompurify.

[psiinon]

I have no problem adding DOMPurify to the ZAP domain - it could definitely prove useful. We're trying to limit what we include on the target domain, but that doesnt apply in this case.

[mozfreddyb]

if I were to add dompurify as a dependency in package.json - do you have a build step to move a copy to src/main/zapHomeFiles/hud/libraries?

[mozfreddyb]

Ah, I did not see you self-assigned. Nevermind then :-) I'll modify #620 to have the linter accept dompurify as an exception

[psiinon]

Yes, the HUD runtime JS is delivered by ZAP so we need it there.
And please got ahead with that change - I was going to look at the 3rd one first :)

[thc202]

do you have a build step to move a copy to src/main/zapHomeFiles/hud/libraries?

Which ones are copied are tracked here:

zap-hud/build.gradle.kts

Lines 96 to 106 in c1839b1

	val copyNpmDeps by tasks.registering(Copy::class) {
	group = LifecycleBasePlugin.BUILD_GROUP
	description = "Copies the (required) npm dependencies for the add-on."
	dependsOn(installNpmDeps)
	from("node_modules/vue/dist/vue.js")
	from("node_modules/vue-i18n/dist/vue-i18n.js")
	from("node_modules/localforage/dist/localforage.min.js")
	into(npmDepsDir.map({ it.file("hud/libraries/") }))
	}