PRJ-868 Avoid using HTML plain text injections

Author: SerVB

projector-client-web/src/main/kotlin/org/jetbrains/projector/client/web/state/ClientState.kt

@@ -624,10 +624,10 @@ sealed class ClientState {
 
         false -> OnScreenMessenger.showText(
           "Connection problem",
-          "There is no connection to <strong>$url</strong>. " +
+          "There is no connection to $url. " +
           "The browser console can contain the error and a more detailed description. " +
-          "Everything we know is that <code>CloseEvent.code=${action.code}</code>, " +
-          "<code>CloseEvent.wasClean=${action.wasClean}</code>. $reason",
+          "Everything we know is that CloseEvent.code=${action.code}, " +
+          "CloseEvent.wasClean=${action.wasClean}. $reason",
           canReload = true
         )
       }

projector-client-web/src/main/kotlin/org/jetbrains/projector/client/web/window/OnScreenMessenger.kt

@@ -32,6 +32,7 @@ import org.jetbrains.projector.client.web.state.ProjectorUI
 import org.jetbrains.projector.common.protocol.data.CommonRectangle
 import org.jetbrains.projector.util.logging.Logger
 import org.w3c.dom.HTMLDivElement
+import org.w3c.dom.HTMLParagraphElement
 
 object OnScreenMessenger : LafListener {
 
@@ -57,7 +58,7 @@ object OnScreenMessenger : LafListener {
     }
   }
 
-  private val text = (document.createElement("div") as HTMLDivElement).apply {
+  private val text = (document.createElement("p") as HTMLParagraphElement).apply {
     div.appendChild(this)
   }
 
@@ -75,7 +76,7 @@ object OnScreenMessenger : LafListener {
     logger.info { "$title - $content" }
 
     header.title = title
-    text.innerHTML = "<p>$content</p>"
+    text.innerText = content
 
     reload.style.display = canReload.toDisplayType()