From 84634158a9d243ffa915ab9f1ec76bbf0c13774e Mon Sep 17 00:00:00 2001
From: "mend-for-github-com[bot]"
 <50673670+mend-for-github-com[bot]@users.noreply.github.com>
Date: Mon, 24 Aug 2026 18:58:16 +0000
Subject: [PATCH] Remediated vulnerable source file:
 src/main/resources/lessons/xss/js/stored-xss.js

---
 src/main/resources/lessons/xss/js/stored-xss.js | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/src/main/resources/lessons/xss/js/stored-xss.js b/src/main/resources/lessons/xss/js/stored-xss.js
index 57cc3dc55..e75df55d1 100644
--- a/src/main/resources/lessons/xss/js/stored-xss.js
+++ b/src/main/resources/lessons/xss/js/stored-xss.js
@@ -1,3 +1,4 @@
+var escape = require('escape-html');
 $(document).ready(function () {
     $("#postComment").on("click", function () {
         var commentInput = $("#commentInput").val();
@@ -34,9 +35,9 @@ $(document).ready(function () {
         $("#list").empty();
         $.get('CrossSiteScripting/stored-xss', function (result, status) {
             for (var i = 0; i < result.length; i++) {
-                var comment = html.replace('USER', result[i].user);
-                comment = comment.replace('DATETIME', result[i].dateTime);
-                comment = comment.replace('COMMENT', result[i].text);
+                var comment = html.replace('USER', escape(result[i].user));
+                comment = comment.replace('DATETIME', escape(result[i].dateTime));
+                comment = comment.replace('COMMENT', escape(result[i].text));
                 $("#list").append(comment);
             }