From bd480aa1db4ace2342c7cf18a4af01fc20506c58 Mon Sep 17 00:00:00 2001
From: Ian Walton <ian@iwalton.com>
Date: Sat, 22 Apr 2023 10:12:58 -0400
Subject: [PATCH] Escape device id in raw HTML.

---
 src/controllers/dashboard/devices/devices.js | 7 ++++---
 src/scripts/imagehelper.js                   | 1 +
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/src/controllers/dashboard/devices/devices.js b/src/controllers/dashboard/devices/devices.js
index d57652ed11..b72bc1de06 100644
--- a/src/controllers/dashboard/devices/devices.js
+++ b/src/controllers/dashboard/devices/devices.js
@@ -96,11 +96,12 @@ import confirm from '../../../components/confirm/confirm';
         let html = '';
         html += devices.map(function (device) {
             let deviceHtml = '';
-            deviceHtml += "<div data-id='" + device.Id + "' class='card backdropCard'>";
+            deviceHtml += "<div data-id='" + escapeHtml(device.Id) + "' class='card backdropCard'>";
             deviceHtml += '<div class="cardBox visualCardBox">';
             deviceHtml += '<div class="cardScalable">';
             deviceHtml += '<div class="cardPadder cardPadder-backdrop"></div>';
-            deviceHtml += `<a is="emby-linkbutton" href="${canEdit ? '#!/device.html?id=' + device.Id : '#'}" class="cardContent cardImageContainer ${cardBuilder.getDefaultBackgroundClass()}">`;
+            deviceHtml += `<a is="emby-linkbutton" href="${canEdit ? '#!/device.html?id=' + escapeHtml(device.Id) : '#'}" class="cardContent cardImageContainer ${cardBuilder.getDefaultBackgroundClass()}">`;
+            // audit note: getDeviceIcon returns static text
             const iconUrl = imageHelper.getDeviceIcon(device);
 
             if (iconUrl) {
@@ -116,7 +117,7 @@ import confirm from '../../../components/confirm/confirm';
 
             if (canEdit || canDelete(device.Id)) {
                 deviceHtml += '<div style="text-align:right; float:right;padding-top:5px;">';
-                deviceHtml += '<button type="button" is="paper-icon-button-light" data-id="' + device.Id + '" title="' + globalize.translate('Menu') + '" class="btnDeviceMenu"><span class="material-icons more_vert" aria-hidden="true"></span></button>';
+                deviceHtml += '<button type="button" is="paper-icon-button-light" data-id="' + escapeHtml(device.Id) + '" title="' + globalize.translate('Menu') + '" class="btnDeviceMenu"><span class="material-icons more_vert" aria-hidden="true"></span></button>';
                 deviceHtml += '</div>';
             }
 
diff --git a/src/scripts/imagehelper.js b/src/scripts/imagehelper.js
index 4fd2c0a0c7..5700add95d 100644
--- a/src/scripts/imagehelper.js
+++ b/src/scripts/imagehelper.js
@@ -1,5 +1,6 @@
 
 /* eslint-disable indent */
+// audit note: this module is expected to return safe text for use in HTML
 
     export function getDeviceIcon(device) {
         const baseUrl = 'assets/img/devices/';