fix: replace innerHTML with secure DOM manipulation to prevent XSS vulnerabilities

[Suke2004]

Description:
The content script uses innerHTML to insert untrusted data, exposing potential XSS risks if the API returns malicious content. This must be replaced with safe DOM methods.

✅ Acceptance Criteria:

• Replace all innerHTML with textContent or safe DOM element creation.
• If HTML formatting is necessary, use a sanitizer (e.g., DOMPurify).
• Validate all API responses before rendering.
• Test with simulated malicious payloads.

[Syphon73]

Hey, I’d like to work on this issue. Can you please assign it to me?

[BennyPerumalla]

Hey @Syphon73 , Thanks for reaching out.

Before assigning this to you, Can you describe what you are going to do?

[Syphon73]

Hey @BennyPerumalla I looked into the content.js file, and it appears that you’re already using the escapeHTML() function when fetching the API response to prevent XSS attacks. I’m not entirely sure why this issue is still open — if I’m missing something, a clarification would be greatly appreciated. I’d be happy to contribute further once I understand the context.