Merge pull request #24937 from edx/private_to_public_f87e1d2

Mergeback PR from private to public.

cms/static/js/views/container.js

@@ -1,9 +1,9 @@
 define([
     'jquery', 'underscore', 'js/views/xblock', 'js/utils/module',
-    'gettext', 'common/js/components/views/feedback_notification',
-    'jquery.ui'
+    'gettext', 'edx-ui-toolkit/js/utils/string-utils',
+    'common/js/components/views/feedback_notification', 'jquery.ui'
 ], // The container view uses sortable, which is provided by jquery.ui.
-    function($, _, XBlockView, ModuleUtils, gettext, NotificationView) {
+    function($, _, XBlockView, ModuleUtils, gettext, StringUtils, NotificationView) {
         'use strict';
 
         var studioXBlockWrapperClass = '.studio-xblock-wrapper';
@@ -142,7 +142,15 @@ define([
             },
 
             makeRequestSpecificSelector: function(selector) {
-                return 'div.xblock[data-request-token="' + this.requestToken + '"] > ' + selector;
+                return StringUtils.interpolate(
+                    gettext('{startTag}{requestToken}{endTag}{selector}'),
+                    {
+                        startTag: 'div.xblock[data-request-token="',
+                        requestToken: this.requestToken,
+                        endTag: '"] > ',
+                        selector: selector
+                    }
+                );
             }
         });
 

cms/static/js/views/experiment_group_edit.js

@@ -29,7 +29,7 @@ function(BaseView, _, str, gettext, groupEditTemplate) {
             var collection = this.model.collection,
                 index = collection.indexOf(this.model);
 
-            this.$el.html(_.template(groupEditTemplate)({
+            edx.HtmlUtils.setHtml(this.$el, edx.HtmlUtils.template(groupEditTemplate)({
                 name: this.model.get('name'),
                 allocation: this.getAllocation(),
                 index: index,

cms/static/js/views/learning_info.js

@@ -5,9 +5,10 @@ define([
     'underscore',
     'backbone',
     'gettext',
-    'js/utils/templates'
+    'js/utils/templates',
+    'edx-ui-toolkit/js/utils/html-utils'
 ],
-function($, _, Backbone, gettext, TemplateUtils) {
+function($, _, Backbone, gettext, TemplateUtils, HtmlUtils) {
     'use strict';
     var LearningInfoView = Backbone.View.extend({
 
@@ -33,7 +34,12 @@ function($, _, Backbone, gettext, TemplateUtils) {
             var self = this;
             var learning_information = this.model.get('learning_info');
             $.each(learning_information, function(index, info) {
-                $(self.el).append(self.template({index: index, info: info, info_count: learning_information.length}));
+                var attributes = {
+                    index: index,
+                    info: info,
+                    info_count: learning_information.length
+                };
+                $(self.el).append(HtmlUtils.HTML(self.template(attributes)).toString());
             });
         },
 

cms/static/js/views/list_item.js

@@ -12,9 +12,10 @@
  *   to the DOM.
  */
 define([
-    'js/views/baseview', 'jquery', 'gettext', 'common/js/components/utils/view_utils'
+    'js/views/baseview', 'jquery', 'gettext',
+    'common/js/components/utils/view_utils', 'edx-ui-toolkit/js/utils/html-utils'
 ], function(
-    BaseView, $, gettext, ViewUtils
+    BaseView, $, gettext, ViewUtils, HtmlUtils
 ) {
     'use strict';
 
@@ -81,7 +82,7 @@ define([
                 this.view = this.createDetailsView();
             }
 
-            this.$el.html(this.view.render().el);
+            this.$el.html(HtmlUtils.HTML(this.view.render().el).toString());
 
             return this;
         }

lms/templates/ccx/coach_dashboard.html

@@ -129,8 +129,9 @@ from openedx.core.djangolib.js_utils import (
           studentId = $('<input />', {
             type: 'hidden',
             name: 'student-id',
-            value: selectedStudent
+            value: edx.HtmlUtils.ensureHtml(selectedStudent)
           });
+          // xss-lint: disable=javascript-jquery-append
           form.append(action, studentId).submit();
         }
     });
@@ -153,7 +154,7 @@ from openedx.core.djangolib.js_utils import (
       $errorMessage.show();
       return false;
     } else if (hasCcxConnector) {
-      $errorMessage.html('${use_ccx_con_error_message | n, js_escaped_string}');
+      $errorMessage.text('${use_ccx_con_error_message | n, js_escaped_string}');
       $errorMessage.show();
       return false;
     }

lms/templates/components/card/card.underscore

@@ -6,7 +6,7 @@
         <% } %>
         <h3 class="card-title"
             <% if (!_.isUndefined(srInfo)) { %>
-                aria-describedby="<%= srInfo.id %>"
+                aria-describedby="<%- srInfo.id %>"
             <% } %>
             ><%- title %>
         </h3>
@@ -17,7 +17,8 @@
     <div class="card-meta">
     </div>
     <div class="card-actions">
-        <a class="action <%= action_class %>" href="<%= action_url %>"><%= action_content %></a>
+        <% // xss-lint: disable=underscore-not-escaped %>
+        <a class="action <%- action_class %>" href="<%- action_url %>"><%= action_content %></a>
     </div>
 </div>
 <% } else { %>
@@ -28,14 +29,15 @@
         <% } %>
         <h3 class="card-title"
             <% if (!_.isUndefined(srInfo)) { %>
-                aria-describedby="<%= srInfo.id %>"
+                aria-describedby="<%- srInfo.id %>"
             <% } %>
             ><%- title %>
         </h3>
         <p class="card-description"><%- description %></p>
     </div>
     <div class="card-actions">
-        <a class="action <%= action_class %>" href="<%= action_url %>"><%= action_content %></a>
+        <% // xss-lint: disable=underscore-not-escaped %>
+        <a class="action <%- action_class %>" href="<%- action_url %>"><%= action_content %></a>
     </div>
 </div>
 <div class="wrapper-card-meta">

lms/templates/edxnotes/note-item.underscore

@@ -18,6 +18,7 @@
         <li class="note-comment">
             <p class="note-comment-title"><%- gettext("You commented...") %></p>
             <p class="note-comment-p">
+                <% // xss-lint: disable=underscore-not-escaped %>
                 <%= interpolate_text(_.escape(text), {
                     elasticsearch_highlight_start: '<span class="note-highlight">',
                     elasticsearch_highlight_end: '</span>'
@@ -32,7 +33,7 @@
     <div class="wrapper-reference-content">
         <p class="reference-title"><%- gettext("Noted in:") %></p>
         <% if (unit.url) { %>
-          <a class="reference-meta reference-unit-link" href="<%= unit.url %>#<%= id %>"><%- unit.display_name %></a>
+          <a class="reference-meta reference-unit-link" href="<%- unit.url %>#<%- id %>"><%- unit.display_name %></a>
         <% } else { %>
           <span class="reference-meta"><%- unit.display_name %></span>
         <% } %>
@@ -44,6 +45,7 @@
             <p class="reference-title"><%- gettext("Tags:") %></p>
             <% for (var i = 0; i < tags.length; i++) { %>
                 <span class="reference-meta reference-tags">
+                    <% // xss-lint: disable=underscore-not-escaped %>
                     <%= interpolate_text(_.escape(tags[i]), {
                         elasticsearch_highlight_start: '<span class="note-highlight">',
                         elasticsearch_highlight_end: '</span>'

lms/templates/edxnotes/tab-item.underscore

@@ -1,7 +1,7 @@
 <% var hasIcon = icon ? 1 : 0; %>
 
 <a class="tab-label <% if (hasIcon) { print('has-icon') } %>" href="#">
-  <% if (hasIcon) { %><span class="icon <%= icon %>" aria-hidden="true"></span> <% } %><%- gettext(name) %>
+  <% if (hasIcon) { %><span class="icon <%- icon %>" aria-hidden="true"></span> <% } %><%- gettext(name) %>
 </a>
 
 <% if (is_closable) { %>

lms/templates/fields/field_image.underscore

@@ -1,16 +1,18 @@
 <div class="image-wrapper">
-    <img class="image-frame" src="<%- imageUrl %>"  alt="<%=imageAltText%>"/>
+    <img class="image-frame" src="<%- imageUrl %>"  alt="<%-imageAltText%>"/>
     <div class="u-field-actions">
         <label class="u-field-upload-button">
+            <% // xss-lint: disable=underscore-not-escaped %>
             <span class="upload-button-icon" aria-hidden="true"><%= uploadButtonIcon %></span>
-            <span class="upload-button-title" aria-live="polite"><%= uploadButtonTitle %></span>
-            <input class="upload-button-input" type="file" name="<%= inputName %>"/>
+            <span class="upload-button-title" aria-live="polite"><%- uploadButtonTitle %></span>
+            <input class="upload-button-input" type="file" name="<%- inputName %>"/>
        	</label>
-       	<button class="upload-submit" type="button" hidden="true"><%= uploadButtonTitle %></button>
+       	<button class="upload-submit" type="button" hidden="true"><%- uploadButtonTitle %></button>
         <button class="u-field-remove-button" type="button">
+            <% // xss-lint: disable=underscore-not-escaped %>
             <span class="remove-button-icon" aria-hidden="true"><%= removeButtonIcon %></span>
-            <span class="remove-button-title" aria-live="polite"><%= removeButtonTitle %></span>
-            <span class="sr"><%= screenReaderTitle %></span>
+            <span class="remove-button-title" aria-live="polite"><%- removeButtonTitle %></span>
+            <span class="sr"><%- screenReaderTitle %></span>
         </button>
     </div>
 </div>

lms/templates/instructor/instructor_dashboard_2/enrollment-code-lookup-links.underscore

@@ -12,7 +12,7 @@
             <td> <%- is_registration_code_valid %> </td>
             <td>
                 <% _.each(actions, function(action){ %>
-                    <a class="registration_code_action_link" data-registration-code="<%= action.registration_code %>" data-action-type="<%= action.action_type %>" href="#" data-endpoint="<%= action.action_url %>">
+                    <a class="registration_code_action_link" data-registration-code="<%- action.registration_code %>" data-action-type="<%- action.action_type %>" href="#" data-endpoint="<%- action.action_url %>">
                         <%- action.action_name %>
                     </a>
                 <% }); %>

lms/templates/learner_dashboard/program_card.underscore

@@ -57,7 +57,7 @@
             <source srcset="<%- smallBannerUrl %>" media="(max-width: <%- breakpoints.max.small %>)">
             <source srcset="<%- mediumBannerUrl %>" media="(max-width: <%- breakpoints.max.medium %>)">
             <source srcset="<%- xsmallBannerUrl %>" media="(max-width: <%- breakpoints.max.large %>)">
-            <img class="banner-image" srcset="<%- smallBannerUrl %>" alt="<%= interpolate(gettext('%(programName)s Home Page.'), {programName: title}, true)%>">
+            <img class="banner-image" srcset="<%- smallBannerUrl %>" alt="<%- interpolate(gettext('%(programName)s Home Page.'), {programName: title}, true)%>">
         </picture>
     </div>
 </a>

lms/templates/video.html

@@ -2,7 +2,9 @@
 
 <%!
 from django.utils.translation import ugettext as _
-from openedx.core.djangolib.js_utils import js_escaped_string
+from openedx.core.djangolib.js_utils import (
+    dump_js_escaped_json, js_escaped_string
+)
 %>
 % if display_name is not UNDEFINED and display_name is not None:
     <h3 class="hd hd-2">${display_name}</h3>
@@ -98,14 +100,14 @@ from openedx.core.djangolib.js_utils import js_escaped_string
   var salt = Math.floor((1 + Math.random()) * 0x100000).toString(36);
   var id = "${id | n, js_escaped_string}";
   function initializeCDNExperiment() {
-    sendPerformanceBeacon(id + "_" + salt, ${cdn_exp_group}, "", "load");
+    sendPerformanceBeacon(id + "_" + salt, ${cdn_exp_group | n, dump_js_escaped_json}, "", "load");
     cdnStartTime = Date.now();
     $.each(['loadstart', 'abort', 'error', 'stalled', 'loadedmetadata',
                     'loadeddata', 'canplay', 'canplaythrough', 'seeked'],
                     function(index, eventName) {
       $("#video_" + id).bind("html5:" + eventName, null, function() {
         timeElapsed = Date.now() - cdnStartTime;
-        sendPerformanceBeacon(id + "_" + salt, ${cdn_exp_group}, timeElapsed, eventName);
+        sendPerformanceBeacon(id + "_" + salt, ${cdn_exp_group | n, dump_js_escaped_json}, timeElapsed, eventName);
       });
     });
   }