cat << 'EOF' | git apply
diff --git a/test/dummy/frontend/js/views/user/rooms/List.js b/test/dummy/frontend/js/views/user/rooms/List.js
--- a/test/dummy/frontend/js/views/user/rooms/List.js
+++ b/test/dummy/frontend/js/views/user/rooms/List.js
@@ -5,25 +5,40 @@
 
 let rooms = [];
 
+// Function to escape user input to prevent XSS
+function escapeHtml(unsafe) {
+ return String(unsafe)
+ .replace(/&/g, "&amp;")
+ .replace(/</g, "&lt;")
+ .replace(/>/g, "&gt;")
+ .replace(/"/g, "&quot;")
+ .replace(/'/g, "&#039;");
+}
+
 const roomTmpl = ({ id, name, members_count, joined }) => {
+ // All variables interpolated into HTML must be escaped
+ const safeId = escapeHtml(id);
+ const safeName = escapeHtml(name);
+ const safeMembersCount = escapeHtml(members_count);
+ const safeJoined = !!joined; // Boolean - not user-supplied, safe
 return `
- <tr id="room_${id}">
- <td>${name}</td>
- <td class="members">${members_count}</td>
+ <tr id="room_${safeId}">
+ <td>${safeName}</td>
+ <td class="members">${safeMembersCount}</td>
 <td>
 <a
 rel="nofollow"
 data-turbo-method="patch"
- href="${joined ? `/user/rooms/${id}/leave` : `/user/rooms/${id}/join`}"
+ href="${safeJoined ? `/user/rooms/${safeId}/leave` : `/user/rooms/${safeId}/join`}"
 >
- ${joined ? "Leave" : "Join"}
+ ${safeJoined ? "Leave" : "Join"}
 </a>
 |
 <a
 rel="nofollow"
 data-turbo-method="delete"
 data-turbo-confirm="R U sure?"
- href="/user/rooms/${id}"
+ href="/user/rooms/${safeId}"
 >
 Destroy
 </a>
EOF