Fix some timing and display issues with the supervised-user confirmation.

chrome/browser/resources/options/managed_user_create_confirm.js

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 cr.define('options', function() {
   var OptionsPage = options.OptionsPage;
 
   /**
    * ManagedUserCreateConfirm class.
    * Encapsulated handling of the confirmation overlay page when creating a
@@ skipping 34 matching lines @@
       };
     },
 
     /**
      * Sets the profile info used in the dialog and updates the profile name
      * displayed. Called by the profile creation overlay when this overlay is
      * opened.
      * @param {Object} info An object of the form:
      *     info = {
      *       name: "Profile Name",
-     *       filePath: "/path/to/profile/data/on/disk"
+     *       filePath: "/path/to/profile/data/on/disk",
      *       isManaged: (true|false)
+     *       custodianEmail: "example@gmail.com"
      *     };
      * @private
      */
     setProfileInfo_: function(info) {
+      function HTMLEscape(original) {
+        return original.replace(/&/g, '&')
+                       .replace(/</g, '&lt;')
+                       .replace(/>/g, '&gt;')
+                       .replace(/"/g, '&quot;')
+                       .replace(/'/g, '&#39;');
+      }
+
       this.profileInfo_ = info;
       $('managed-user-created-title').textContent =
           loadTimeData.getStringF('managedUserCreatedTitle', info.name);
-      $('managed-user-created-text').textContent =
-          loadTimeData.getStringF('managedUserCreatedText',
-                                  info.name,
-                                  loadTimeData.getString('custodianEmail'));
       $('managed-user-created-switch').textContent =
           loadTimeData.getStringF('managedUserCreatedSwitch', info.name);
+
+      // HTML-escape the user-supplied strings before putting them into
+      // innerHTML. This is probably excessive for the email address, but
+      // belt-and-suspenders is cheap here.
+      $('managed-user-created-text').innerHTML =
+          loadTimeData.getStringF('managedUserCreatedText',
+                                  HTMLEscape(info.name),
+                                  HTMLEscape(info.custodianEmail));
     },
   };
 
   // Forward public APIs to private implementations.
   [
     'setProfileInfo',
   ].forEach(function(name) {
     ManagedUserCreateConfirmOverlay[name] = function() {
       var instance = ManagedUserCreateConfirmOverlay.getInstance();
       return instance[name + '_'].apply(instance, arguments);
     };
   });
 
   // Export
   return {
     ManagedUserCreateConfirmOverlay: ManagedUserCreateConfirmOverlay,
   };
 });