[BUG] Consider removing innerHTML usage

Expected Behavior

Firefox addons being accepted without warnings around Chart.js.

Current Behavior

Submitting an addon to the Firefox store gives:

⚠ Unsafe assignment to innerHTML

Warning: Due to both security…

When searching through master, I get one offending line:

https://github.com/chartjs/Chart.js/blob/75aa44eef677b790768262638df0de223fd01a56/src/platforms/platform.dom.js#L187-L205

At first glance this seems to be the same usage in the minified build.

Possible Solution

Unsure, but perhaps there’s another way to do the same thing in that line?

Steps to Reproduce (for bugs)

1. Follow the Firefox addon submission wizard for an addon that includes Chart.min.js as a content_script

Context

Reviews of such addons tend to take longer, or the addon might even be rejected based on this.

Environment

• Chart.js version: 2.7.3
• Browser name and version: n/a
• Link to your project: n/a

[benmccann]

You could use document.createElement, appendChild, etc. to create the dom structure without using innerHTML. Feel free to send a PR

[jeroenheijmans]

Built that branch and verified my app keeps working as expected, and that the Mozilla add on store doesn’t give any warnings anymore.

Thanks!