Close CodeQL's findings in the webview-ui test helpers

packages/webview-ui/test/avatar.cov.test.ts

@@ -93,7 +93,7 @@ test("a photo that already loaded once renders visible straight away", () => {
 
 test("the avatar markup escapes the name, the ring and the URL", () => {
   const html = avatarHtml("<b", "x@y", 0, 'red" onmouseover="x', 'https://e/"><script>', false);
-  assert.doesNotMatch(html, /<script>|<b|onmouseover="x/);
+  for (const raw of ["<script>", "<b", 'onmouseover="x']) assert.ok(!html.includes(raw), raw);
   assert.match(html, /<span class="fallback">&lt;B<\/span>/);
   assert.match(html, /--gs-av-ring:red&quot; onmouseover=&quot;x"/);
   assert.match(html, /src="https:\/\/e\/&quot;&gt;&lt;script&gt;"/);

packages/webview-ui/test/fakeDom.cov.ts

@@ -69,7 +69,15 @@ export class FakeElement {
   }
 
   get textContent(): string {
-    if (this.rawHtml) return this.rawHtml.replace(/<[^>]*>/g, "");
+    if (this.rawHtml) {
+      // Until nothing changes: one pass over "<<b>b>" leaves a "<b>" behind.
+      let text = this.rawHtml;
+      for (let prev = ""; prev !== text; ) {
+        prev = text;
+        text = text.replace(/<[^>]*>/g, "");
+      }
+      return text;
+    }
     return this.childNodes.map((n) => n.textContent).join("");
   }
   set textContent(v: string) {

packages/webview-ui/test/refTip.cov.test.ts

@@ -112,7 +112,7 @@ test("a hostile ref name reaches the card as text, in the row and in its attribu
   ]);
   tip.handleOver(over(pill));
   tick(90);
-  assert.doesNotMatch(card.innerHTML, /<img|<script>|data-full="refs\/tags\/"x"/);
+  for (const raw of ["<img", "<script>", 'data-full="refs/tags/"x"']) assert.ok(!card.innerHTML.includes(raw), raw);
   assert.match(card.innerHTML, /data-ref="&quot;&gt;&lt;img src=x onerror=alert\(1\)&gt;"/);
   assert.match(card.innerHTML, /also on &lt;script&gt;/);
 });