Password manager internals page: Improve security

chrome/browser/resources/password_manager_internals/password_manager_internals.js

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+// |logText| is expected to be escaped for HTML.
 function addSavePasswordProgressLog(logText) {
   var logDiv = $('log-entries');
   if (!logDiv)
     return;
   logDiv.appendChild(document.createElement('hr'));
   var textDiv = document.createElement('div');
-  textDiv.innerText = logText;
+  textDiv.innerHTML = logText;

[Tom Sepez, 2014/04/11 18:57:43]

Oh, not so good.  How can we avoid this?

[vabr (Chromium), 2014/04/11 19:03:14]

I can revert it to innerText without much troubles (I'm not too concerned with a
potential ugliness of the output).

My thoughts were that since the renderer is already not trusted and we need to
ensure escaping the string in the browser, using innerText here would be just a
theatre. Am I mistaken?

   logDiv.appendChild(textDiv);
 }