Update matchers.ts DOM text reinterpreted as HTML

[Shivam7-1]

By using innerText, it will avoid the risk of HTML injection, as these properties automatically escape any HTML special characters in the provided text. This helps prevent cross-site scripting (XSS) vulnerabilities by treating the input as plain text rather than interpreted HTML.

[NullVoxPopuli]

is there a risk of XSS in the test suite?
there is no user input there

[Shivam7-1]

Hi @NullVoxPopuli Yes You are Right But as Safe manner and good practice innertext would be more secure
Thanks

[CvX]

I wonder how many collective hours are wasted on reviewing spam PRs… 🥲

See e.g.

• Update dom.ts DOM text reinterpreted as HTML data#9440
• Update timeline-track-stacked-base.mjs DOM text reinterpreted as HTML v8/node#184
• Update range-view.ts DOM text reinterpreted as HTML v8/v8#90
• Update details-selection.js Uses DOMPurify v8/v8#91
• Fix: Update Angular index.html DOM text reinterpreted as HTML angular/angular#55751
• Update search.js DOM text reinterpreted as HTML chromeos/chromeos.dev#742
• Update fontdeck.html DOM text reinterpreted as HTML django/djangoproject.com#1531
• Update custom.html DOM text reinterpreted as HTML django/djangoproject.com#1532
• Update excanvas.js DOM text reinterpreted as HTML django/djangoproject.com#1533
• Update files.js DOM text reinterpreted as HTML chromeos/bridging-the-native-app-gap#68