Improve HTML content sanitization and fix linting issues

[stephenegriffin]

This pull request refactors how URLs and potentially unsafe HTML content are handled and rendered, especially in the ArchivedRow component and related UI. The main goal is to improve security by ensuring that only valid URLs are rendered as links and all other content is properly HTML-encoded. Additionally, the PR updates tests to reflect these changes and cleans up some ESLint settings.

Security and rendering improvements:

• src/Scripts/row/ArchivedRow.ts: Replaces the generic Strings.mapValueToURL with a stricter valueUrl getter. Now, only strict angle-bracketed HTTP(S) URLs are rendered as clickable links; all other values are safely HTML-encoded, preventing executable HTML from being rendered.
• src/Scripts/Strings.ts: Removes the now-unused mapValueToURL method.

UI updates for safe encoding:

• src/Scripts/ui/newMobilePaneIosFrame.ts: Updates all instances where user-supplied values are rendered into the DOM to use Strings.htmlEncode, ensuring that names, addresses, and values in the UI are always encoded and safe to display. [1] [2] [3] [4]

Testing improvements:

• src/Scripts/row/ArchivedRow.test.ts: Updates and extends tests for ArchivedRow to cover the new logic, including strict URL detection, proper encoding of potentially dangerous payloads, and RFC2047 decoding scenarios. Mocks are improved to use real implementations for encoding functions.

Tooling configuration:

• .vscode/settings.json: Changes ESLint auto-fix on save to use the ESLint-specific fix action, aligning with best practices and preventing unintended fixes from other sources.

[Copilot]

Pull request overview

This PR tightens how potentially unsafe header/UI content is rendered in the Outlook add-in, aiming to prevent HTML injection by encoding user-controlled values and restricting when URLs become clickable links.

Changes:

• Updated ArchivedRow URL rendering logic to only link strict angle-bracketed HTTP(S) URLs; otherwise HTML-encode content.
• Switched several innerHTML render paths in the iOS mobile pane to HTML-encode user-controlled values before insertion.
• Removed the now-unused Strings.mapValueToURL helper and updated unit tests and editor ESLint-on-save configuration.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
src/Scripts/ui/newMobilePaneIosFrame.ts	Encodes user-controlled values before inserting into innerHTML in the mobile UI.
src/Scripts/Strings.ts	Removes mapValueToURL helper.
src/Scripts/row/ArchivedRow.ts	Refactors Archived-At rendering to validate and link only strict HTTP(S) URLs.
src/Scripts/row/ArchivedRow.test.ts	Updates tests for new ArchivedRow behavior and mocking approach.
.vscode/settings.json	Uses ESLint-specific fix action on save.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 4 comments.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.