Blast radius UI: Fix rendering of <init> methods

Methods on the form "void a.b.C.<init>()" are incorrectly rendered as
"void a.b.C.()".

Bug: b/483560331
Change-Id: Iac19814a89c7edc6e1e64fa5e11e556f343df319

src/blastradius/web/main.js

diff --git a/src/blastradius/web/main.js b/src/blastradius/web/main.js
index 6aa3439..9b85992 100644
--- a/src/blastradius/web/main.js
+++ b/src/blastradius/web/main.js
@@ -433,14 +433,14 @@
                         <div style="margin-top: 0.5rem;">
                             <div class="subsumed-by-item">
                                 <div style="font-weight: 500;">${r ? escapeHtml(r.source) : `Rule ID: ${id}`}</div>
-                                <div style="font-size: 0.8rem; color: #666; margin-top: 2px;">Origin: ${originStr}</div>
+                                <div style="font-size: 0.8rem; color: #666; margin-top: 2px;">Origin: ${escapeHtml(originStr)}</div>
                             </div>
                         </div>
                     </div>
                 `;
             }).join('') : ''}
             <div class="keep-rule-source">${escapeHtml(rule.source)}</div>
-            <p><strong>Origin:</strong> ${getOriginString(rule.origin)}</p>
+            <p><strong>Origin:</strong> ${escapeHtml(getOriginString(rule.origin))}</p>
         </div>
     `;
 
@@ -485,8 +485,8 @@
                     ${visibleItems.map(id => {
                         const info = type === 'class' ? tables.classes.get(id) :
                                    (type === 'method' ? tables.methods.get(id) : tables.fields.get(id));
-                        return info ? `<li>${formatter(type === 'class' ? info.classReferenceId :
-                                                     (type === 'method' ? info.methodReferenceId : info.fieldReferenceId))}</li>`
+                        return info ? `<li>${escapeHtml(formatter(type === 'class' ? info.classReferenceId :
+                                                     (type === 'method' ? info.methodReferenceId : info.fieldReferenceId)))}</li>`
                                     : `<li>Unknown ${type} ID ${id}</li>`;
                     }).join('')}
                 </ul>