Potential fix for code scanning alert no. 32: Client-side cross-site scripting

[rajbos]

Potential fix for https://github.com/rajbos/github-copilot-token-usage/security/code-scanning/32

In general, to fix DOM-based XSS when writing untrusted data into a webpage, either (1) avoid innerHTML by constructing DOM nodes with textContent/setAttribute, or (2) ensure that every piece of untrusted data that flows into HTML or attributes is validated and contextually escaped. Here we are constrained to the existing pattern of generating an HTML string and setting innerHTML, so the best fix is to ensure that all tainted values used inside that HTML are safely transformed first.

The concrete tainted path CodeQL flags runs through formatFileSize(sf.size), where sf.size ultimately comes from event.data. The safest minimal change is to harden formatFileSize so that it (a) defensively coerces its input to a finite non‑negative number and (b) falls back to a safe placeholder if coercion fails. This prevents any non-numeric or unexpected value from being reflected verbatim into the DOM, even if the SessionFileDetails object is malformed or attacker-controlled. No behavioral change occurs for valid numeric inputs, and the rest of the rendering logic remains unchanged.

To implement this in src/webview/diagnostics/main.ts:

• Modify formatFileSize(bytes: number): string to:
  • Coerce bytes with Number(bytes) into const numericBytes.
  • Check Number.isFinite(numericBytes) and numericBytes >= 0; if these fail, return a neutral string like "N/A".
  • Use numericBytes for all subsequent comparisons and arithmetic.
• This change lives entirely within the existing function at lines 158–165; no imports or new helpers are required, and all current call sites (formatFileSize(sf.size)) continue to work.

This makes it clear to CodeQL (and to human reviewers) that tainted inputs are sanitized before being included in the HTML, eliminating the flagged vulnerability path.

---

Suggested fixes powered by Copilot Autofix. Review carefully before merging.