replace innerHTML to safer textContent where possible

assets/js/community.js

@@ -1,5 +1,5 @@
 'use strict';
-var community_data = JSON.parse(document.getElementById('community_data').innerHTML);
+var community_data = JSON.parse(document.getElementById('community_data').textContent);
 
 String.prototype.supplant = function (o) {
     return this.replace(/{([^{}]*)}/g, function (a, b) {

assets/js/embed.js

@@ -1,5 +1,5 @@
 'use strict';
-var video_data = JSON.parse(document.getElementById('video_data').innerHTML);
+var video_data = JSON.parse(document.getElementById('video_data').textContent);
 
 function get_playlist(plid, retries) {
     if (retries === undefined) retries = 5;

assets/js/notifications.js

@@ -1,5 +1,5 @@
 'use strict';
-var notification_data = JSON.parse(document.getElementById('notification_data').innerHTML);
+var notification_data = JSON.parse(document.getElementById('notification_data').textContent);
 
 var notifications, delivered;
 

assets/js/player.js

@@ -1,6 +1,6 @@
 'use strict';
-var player_data = JSON.parse(document.getElementById('player_data').innerHTML);
-var video_data = JSON.parse(document.getElementById('video_data').innerHTML);
+var player_data = JSON.parse(document.getElementById('player_data').textContent);
+var video_data = JSON.parse(document.getElementById('video_data').textContent);
 
 var options = {
     preload: 'auto',

assets/js/playlist_widget.js

@@ -1,5 +1,5 @@
 'use strict';
-var playlist_data = JSON.parse(document.getElementById('playlist_data').innerHTML);
+var playlist_data = JSON.parse(document.getElementById('playlist_data').textContent);
 
 function add_playlist_video(target) {
     var select = target.parentNode.children[0].children[1];

assets/js/subscribe_widget.js

@@ -1,5 +1,5 @@
 'use strict';
-var subscribe_data = JSON.parse(document.getElementById('subscribe_data').innerHTML);
+var subscribe_data = JSON.parse(document.getElementById('subscribe_data').textContent);
 
 var subscribe_button = document.getElementById('subscribe');
 subscribe_button.parentNode['action'] = 'javascript:void(0)';

assets/js/watch.js

@@ -1,5 +1,5 @@
 'use strict';
-var video_data = JSON.parse(document.getElementById('video_data').innerHTML);
+var video_data = JSON.parse(document.getElementById('video_data').textContent);
 
 String.prototype.supplant = function (o) {
     return this.replace(/{([^{}]*)}/g, function (a, b) {
@@ -11,10 +11,10 @@ String.prototype.supplant = function (o) {
 function toggle_parent(target) {
     var body = target.parentNode.parentNode.children[1];
     if (body.style.display === null || body.style.display === '') {
-        target.innerHTML = '[ + ]';
+        target.textContent = '[ + ]';
         body.style.display = 'none';
     } else {
-        target.innerHTML = '[ - ]';
+        target.textContent = '[ - ]';
         body.style.display = '';
     }
 }
@@ -23,10 +23,10 @@ function toggle_comments(event) {
     var target = event.target;
     var body = target.parentNode.parentNode.parentNode.children[1];
     if (body.style.display === null || body.style.display === '') {
-        target.innerHTML = '[ + ]';
+        target.textContent = '[ + ]';
         body.style.display = 'none';
     } else {
-        target.innerHTML = '[ - ]';
+        target.textContent = '[ - ]';
         body.style.display = '';
     }
 }
@@ -50,7 +50,7 @@ function hide_youtube_replies(event) {
     var body = target.parentNode.parentNode.children[1];
     body.style.display = 'none';
 
-    target.innerHTML = sub_text;
+    target.textContent = sub_text;
     target.onclick = show_youtube_replies;
     target.setAttribute('data-inner-text', inner_text);
     target.setAttribute('data-sub-text', sub_text);
@@ -65,7 +65,7 @@ function show_youtube_replies(event) {
     var body = target.parentNode.parentNode.children[1];
     body.style.display = '';
 
-    target.innerHTML = sub_text;
+    target.textContent = sub_text;
     target.onclick = hide_youtube_replies;
     target.setAttribute('data-inner-text', inner_text);
     target.setAttribute('data-sub-text', sub_text);

assets/js/watched_widget.js

@@ -1,5 +1,5 @@
 'use strict';
-var watched_data = JSON.parse(document.getElementById('watched_data').innerHTML);
+var watched_data = JSON.parse(document.getElementById('watched_data').textContent);
 
 function mark_watched(target) {
     var tile = target.parentNode.parentNode.parentNode.parentNode.parentNode;