From 60d3859a2f11b5f18f183ad5ae715c5cb41bd759 Mon Sep 17 00:00:00 2001
From: Ian Walton <ian@iwalton.com>
Date: Sat, 22 Apr 2023 10:12:58 -0400
Subject: [PATCH] Escape device id in raw HTML.

---
 src/controllers/dashboard/devices/devices.js | 7 ++++---
 src/scripts/imagehelper.js                   | 1 +
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/src/controllers/dashboard/devices/devices.js b/src/controllers/dashboard/devices/devices.js
index 8413c42dee..f28064e09a 100644
--- a/src/controllers/dashboard/devices/devices.js
+++ b/src/controllers/dashboard/devices/devices.js
@@ -90,11 +90,12 @@ function load(page, devices) {
     let html = '';
     html += devices.map(function (device) {
         let deviceHtml = '';
-        deviceHtml += "<div data-id='" + device.Id + "' class='card backdropCard'>";
+        deviceHtml += "<div data-id='" + escapeHtml(device.Id) + "' class='card backdropCard'>";
         deviceHtml += '<div class="cardBox visualCardBox">';
         deviceHtml += '<div class="cardScalable">';
         deviceHtml += '<div class="cardPadder cardPadder-backdrop"></div>';
-        deviceHtml += `<a is="emby-linkbutton" href="#/device.html?id=${device.Id}" class="cardContent cardImageContainer ${cardBuilder.getDefaultBackgroundClass()}">`;
+        deviceHtml += `<a is="emby-linkbutton" href="#!/device.html?id=${escapeHtml(device.Id)}" class="cardContent cardImageContainer ${cardBuilder.getDefaultBackgroundClass()}">`;
+        // audit note: getDeviceIcon returns static text
         const iconUrl = imageHelper.getDeviceIcon(device);
 
         if (iconUrl) {
@@ -113,7 +114,7 @@ function load(page, devices) {
                 deviceHtml += '<div style="text-align:left; float:left;padding-top:5px;">';
             else
                 deviceHtml += '<div style="text-align:right; float:right;padding-top:5px;">';
-            deviceHtml += '<button type="button" is="paper-icon-button-light" data-id="' + device.Id + '" title="' + globalize.translate('Menu') + '" class="btnDeviceMenu"><span class="material-icons more_vert" aria-hidden="true"></span></button>';
+            deviceHtml += '<button type="button" is="paper-icon-button-light" data-id="' + escapeHtml(device.Id) + '" title="' + globalize.translate('Menu') + '" class="btnDeviceMenu"><span class="material-icons more_vert" aria-hidden="true"></span></button>';
             deviceHtml += '</div>';
         }
 
diff --git a/src/scripts/imagehelper.js b/src/scripts/imagehelper.js
index 49fe204b33..052c68111e 100644
--- a/src/scripts/imagehelper.js
+++ b/src/scripts/imagehelper.js
@@ -1,5 +1,6 @@
 const BASE_DEVICE_IMAGE_URL = 'assets/img/devices/';
 
+// audit note: this module is expected to return safe text for use in HTML
 function getWebDeviceIcon(browser) {
     switch (browser) {
         case 'Opera':