Declare Firefox data-collection consent and stop assigning innerHTML in options.

extension/options.js

@@ -31,30 +31,35 @@ function showError(text) {
 }
 
 function render(clients) {
+  rows.replaceChildren();
   if (!clients.length) {
-    rows.innerHTML = '<tr><td colspan="4" class="muted">No clients yet. Generate a secret to get started.</td></tr>';
+    const tr = document.createElement("tr");
+    const td = document.createElement("td");
+    td.colSpan = 4;
+    td.className = "muted";
+    td.textContent = "No clients yet. Generate a secret to get started.";
+    tr.appendChild(td);
+    rows.appendChild(tr);
     return;
   }
-  rows.innerHTML = "";
   for (const client of clients) {
     const tr = document.createElement("tr");
-    tr.innerHTML = `
-      <td>${escapeHtml(client.name)}</td>
-      <td>${escapeHtml(client.created || "")}</td>
-      <td>${escapeHtml(client.last_used || "never")}</td>
-      <td><button type="button" data-revoke="${escapeHtml(client.id)}">Revoke</button></td>`;
+    for (const text of [client.name, client.created || "", client.last_used || "never"]) {
+      const td = document.createElement("td");
+      td.textContent = text;
+      tr.appendChild(td);
+    }
+    const action = document.createElement("td");
+    const btn = document.createElement("button");
+    btn.type = "button";
+    btn.textContent = "Revoke";
+    btn.dataset.revoke = client.id;
+    action.appendChild(btn);
+    tr.appendChild(action);
     rows.appendChild(tr);
   }
 }
 
-function escapeHtml(value) {
-  return String(value)
-    .replace(/&/g, "&amp;")
-    .replace(/</g, "&lt;")
-    .replace(/>/g, "&gt;")
-    .replace(/"/g, "&quot;");
-}
-
 async function refresh() {
   render(await listClients());
   try {