From f1f6c291ab320bdce48b64aa8c67184543e028dd Mon Sep 17 00:00:00 2001
From: root <root@lms.devstack.edx>
Date: Thu, 19 Nov 2020 12:17:44 +0000
Subject: [PATCH] PROD-2250

---
 .../certificates/views/certificate_whitelist.js   | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/lms/static/js/certificates/views/certificate_whitelist.js b/lms/static/js/certificates/views/certificate_whitelist.js
index d39a9b55b5..06d5114689 100644
--- a/lms/static/js/certificates/views/certificate_whitelist.js
+++ b/lms/static/js/certificates/views/certificate_whitelist.js
@@ -8,10 +8,11 @@
         'jquery',
         'underscore',
         'gettext',
-        'backbone'
+        'backbone',
+        'edx-ui-toolkit/js/utils/html-utils'
     ],
 
-        function($, _, gettext, Backbone) {
+        function($, _, gettext, Backbone, HtmlUtils) {
             return Backbone.View.extend({
                 el: '#white-listed-students',
                 message_div: 'div.white-listed-students > div.message',
@@ -32,7 +33,7 @@
 
                 render: function() {
                     var template = this.loadTemplate('certificate-white-list');
-                    this.$el.html(template({certificates: this.collection.models}));
+                    this.$el.html(HtmlUtils.HTML(template({certificates: this.collection.models})).toString());
                     if (!this.active_certificate || this.collection.isEmpty()) {
                         this.$('#generate-exception-certificates').attr('disabled', 'disabled');
                     } else {
@@ -79,7 +80,13 @@
 
                 escapeAndShowMessage: function(message) {
                     $(this.message_div + '>p').remove();
-                    $(this.message_div).removeClass('hidden').append('<p>' + _.escape(message) + '</p>').focus();
+                    // xss-lint: disable=javascript-jquery-append
+                    $(this.message_div).removeClass('hidden').append(HtmlUtils.joinHtml(
+                        HtmlUtils.HTML('<p>'),
+                        _.escape(message),
+                        HtmlUtils.HTML('</p>')
+                    ))
+                    .focus();
                     $(this.message_div).fadeOut(6000, 'linear');
                 },