feat: refactor countdown update in AFKOverlay

[odaysec]

Refactor updateCountdown method to use textContent for countdown updates.

fix unsafe HTML construction, avoid writing untrusted data into innerHTML. Instead, build the DOM structure using document.createElement, and insert dynamic pieces via textContent/innerText or by explicitly setting properties on elements. This prevents the dynamic value from being interpreted as HTML and eliminates the XSS sink.

For this specific case, the overlay content is simple and mostly static. The only dynamic part is the numeric countdown. The safest and least intrusive fix is:

1. Ensure the base DOM structure, including the <span id="afkCountDownNumber">, is created without dynamic content (this is already done in createContentElement).
2. Change updateCountdown so it does not rebuild the full HTML string with innerHTML. Instead, locate the existing <span id="afkCountDownNumber"> within this.textElement and update its textContent with the current countdown value.
3. Keep the method signature and external behavior (the text the user sees) functionally equivalent, just implemented via DOM manipulation instead of string concatenation.

Concretely, in Frontend/ui-library/src/Overlay/AFKOverlay.ts, replace line 47’s innerHTML assignment with logic like:

• Find the span: const span = this.textElement.querySelector('#afkCountDownNumber') as HTMLSpanElement | null;
• If it exists, set span.textContent = String(countdown);
• Optionally, if the span is missing (e.g. defensive), fall back to updating this.textElement.textContent or do nothing; here, a simple defensive check is enough.

No changes are needed in Frontend/ui-library/src/Application/Application.ts, because after the AFKOverlay is made safe, passing countDown into updateCountdown no longer reaches a dangerous sink.

Relevant components:

• Signalling server
• Common library
• Frontend library
• Frontend UI library
• Matchmaker
• Platform scripts
• SFU

[changeset-bot]

⚠️ No Changeset found

Latest commit: a812d0a

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR