fix(core/data-abbr): DOM text reinterpreted as HTML

[marcoscaceres]

Potential fix for https://github.com/speced/respec/security/code-scanning/5

Use DOM APIs to construct nodes and set text/attributes directly instead of insertAdjacentHTML. This preserves existing behavior while preventing HTML reinterpretation.

Best fix in src/core/data-abbr.js:

• In processDfnElement, replace the insertAdjacentHTML call (lines 33–36 region) with:
  • document.createTextNode(" (")
  • document.createElement("abbr")
  • set abbrElem.title = fullForm
  • set abbrElem.textContent = abbr
  • document.createTextNode(")")
  • insert these nodes after dfn in order.
• This removes the HTML sink entirely and addresses both variants, including taint from generateAbbreviation/elem.textContent.

No new imports or dependencies are required.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[marcoscaceres]

@copilot see the CI error about the commit message. Can you fix that please?

[Copilot]

@copilot see the CI error about the commit message. Can you fix that please?

Fixed in 8dc77e0. Updated the commit message to follow the conventional commits format: fix(core/data-abbr): prevent DOM text reinterpreted as HTML. Also simplified the code by removing the redundant openParen/closeParen text node variables.

[Copilot]

Pull request overview

This PR addresses a security finding where DOM text could be reinterpreted as HTML by removing an insertAdjacentHTML sink and constructing the <abbr> node using safe DOM APIs in core/data-abbr.

Changes:

• Replace insertAdjacentHTML usage in processDfnElement() with createElement + property assignment (title, textContent) and adjacent text insertion for parentheses.
• Add a regression test ensuring HTML-special characters in <dfn> text and data-abbr are preserved correctly (no HTML reinterpretation).

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
src/core/data-abbr.js	Removes HTML string insertion and builds the <abbr> + surrounding text nodes via DOM APIs to prevent HTML reinterpretation.
tests/spec/core/data-abbr-spec.js	Adds coverage for special characters in <dfn> text and data-abbr to validate the safer DOM construction behavior.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[marcoscaceres]

@copilot Can you rebase, lint, and prettier this?

[marcoscaceres]

@copilot Can you rebase, lint, and prettier this?

[Copilot]

@copilot Can you rebase, lint, and prettier this?

Done in ef9e43d. Rebased onto current main (squashed to 2 clean commits), ran eslint (no errors), and ran prettier --check (no formatting issues).