fix xss vulnerabilities in jwArray, jwLambda, jwTargets

Author: jwklong

src/extensions/jwArray/index.js

@@ -125,7 +125,7 @@ class ArrayType {
     }
 
     toMonitorContent() {
-        return span(this.toString());
+        return span(escapeHTML(this.toString()));
     }
 
     toReporterContent() {

src/extensions/jwLambda/index.js

@@ -18,7 +18,7 @@ function formatNumber(x) {
 
 function span(text) {
     let el = document.createElement('span')
-    el.innerHTML = text
+    el.innerText = text
     el.style.display = 'hidden'
     el.style.width = '100%'
     el.style.boxSizing = 'border-box'

src/extensions/jwTargets/index.js

@@ -6,7 +6,7 @@ const Cast = require('../../util/cast')
 
 function span(text) {
     let el = document.createElement('span')
-    el.innerHTML = text
+    el.innerText = text
     el.style.display = 'hidden'
     el.style.whiteSpace = 'nowrap'
     el.style.width = '100%'