From 526709e97fce525acc32d80d4229f87218dd9e90 Mon Sep 17 00:00:00 2001
From: Samuel Walladge <samuel@opencraft.com>
Date: Tue, 23 Feb 2021 13:52:04 +1030
Subject: [PATCH 1/3] Apply IM patch for xss fixes 7

https://discuss.openedx.org/t/security-im-patch-for-xss-fixes-7/4198
---
 cms/templates/js/due-date-editor.underscore   |  8 +-
 .../lib/capa/capa/templates/imageinput.html   |  3 +-
 common/lib/symmath/symmath/formula.py         |  6 +-
 common/lib/symmath/symmath/symmath_check.py   | 88 ++++++++++---------
 .../js/capa/drag_and_drop/base_image.js       | 28 +++---
 .../templates/static_templates/contact.html   | 37 ++++----
 .../js/instructor_dashboard/student_admin.js  |  2 +-
 7 files changed, 90 insertions(+), 82 deletions(-)

diff --git a/cms/templates/js/due-date-editor.underscore b/cms/templates/js/due-date-editor.underscore
index 38cf3dac5094..68bab6618b3e 100644
--- a/cms/templates/js/due-date-editor.underscore
+++ b/cms/templates/js/due-date-editor.underscore
@@ -1,12 +1,12 @@
 <ul class="list-fields list-input datepair date-setter">
     <li class="field field-text field-due-date">
-        <label for="due_date"><%= gettext('Due Date:') %></label>
+        <label for="due_date"><%- gettext('Due Date:') %></label>
         <input type="text" id="due_date" name="due_date" value=""
             placeholder="MM/DD/YYYY" class="due-date date input input-text" autocomplete="off"/>
     </li>
 
     <li class="field field-text field-due-time">
-        <label for="due_time"><%= gettext('Due Time in UTC:') %></label>
+        <label for="due_time"><%- gettext('Due Time in UTC:') %></label>
         <input type="text" id="due_time" name="due_time" value=""
             placeholder="HH:MM" class="due-time time input input-text" autocomplete="off" />
     </li>
@@ -14,9 +14,9 @@
 
 <ul class="list-actions">
     <li class="action-item">
-        <a href="#" data-tooltip="<%= gettext('Clear Grading Due Date') %>" class="clear-date action-button action-clear">
+        <a href="#" data-tooltip="<%- gettext('Clear Grading Due Date') %>" class="clear-date action-button action-clear">
             <span class="icon fa fa-undo" aria-hidden="true"></span>
-            <span class="sr"><%= gettext('Clear Grading Due Date') %></span>
+            <span class="sr"><%- gettext('Clear Grading Due Date') %></span>
         </a>
     </li>
 </ul>
diff --git a/common/lib/capa/capa/templates/imageinput.html b/common/lib/capa/capa/templates/imageinput.html
index ca9cfafce8c6..0d6c0d5f6bc2 100644
--- a/common/lib/capa/capa/templates/imageinput.html
+++ b/common/lib/capa/capa/templates/imageinput.html
@@ -1,3 +1,4 @@
+<%page expression_filter="h"/>
 <div class="imageinput capa_inputtype" id="inputtype_${id}">
   <input
     type="hidden"
@@ -37,7 +38,7 @@
   </div>
 
   <script type="text/javascript" charset="utf-8">
-    (new ImageInput('${id}'));
+    (new ImageInput('${id | n, decode.utf8}'));
   </script>
 
   <%include file="status_span.html" args="status=status, status_id=id"/>
diff --git a/common/lib/symmath/symmath/formula.py b/common/lib/symmath/symmath/formula.py
index 45d92a71907d..8f7274ef4a11 100644
--- a/common/lib/symmath/symmath/formula.py
+++ b/common/lib/symmath/symmath/formula.py
@@ -29,6 +29,8 @@
 from sympy.printing.latex import LatexPrinter
 from sympy.printing.str import StrPrinter
 
+from openedx.core.djangolib.markup import HTML
+
 log = logging.getLogger(__name__)
 
 log.warning("Dark code. Needs review before enabling in prod.")
@@ -87,8 +89,8 @@ def to_latex(expr):
 
     #return '<math>%s{}{}</math>' % (xs[1:-1])
     if expr_s[0] == '$':
-        return '[mathjax]%s[/mathjax]<br>' % (expr_s[1:-1])	 # for sympy v6
-    return '[mathjax]%s[/mathjax]<br>' % (expr_s)		# for sympy v7
+        return HTML('[mathjax]{expression}[/mathjax]<br>').format(expression=expr_s[1:-1])	 # for sympy v6
+    return HTML('[mathjax]{expression}[/mathjax]<br>').format(expression=expr_s)		# for sympy v7
 
 
 def my_evalf(expr, chop=False):
diff --git a/common/lib/symmath/symmath/symmath_check.py b/common/lib/symmath/symmath/symmath_check.py
index 85afc3d879cd..76b23e84050b 100644
--- a/common/lib/symmath/symmath/symmath_check.py
+++ b/common/lib/symmath/symmath/symmath_check.py
@@ -11,6 +11,10 @@
 import logging
 import traceback
 
+from markupsafe import escape
+
+from openedx.core.djangolib.markup import HTML
+
 from .formula import *
 
 log = logging.getLogger(__name__)
@@ -48,8 +52,9 @@ def symmath_check_simple(expect, ans, adict={}, symtab=None, extra_options=None)
                     )
     except Exception, err:
         return {'ok': False,
-                'msg': 'Error %s<br/>Failed in evaluating check(%s,%s)' % (err, expect, ans)
-                }
+                'msg': HTML('Error {err}<br/>Failed in evaluating check({expect},{ans})').format(
+                    err=err, expect=expect, ans=ans
+                )}
     return ret
 
 #-----------------------------------------------------------------------------
@@ -92,23 +97,29 @@ def check(expect, given, numerical=False, matrix=False, normphase=False, abcsym=
 
     try:
         xgiven = my_sympify(given, normphase, matrix, do_qubit=do_qubit, abcsym=abcsym, symtab=symtab)
-    except Exception, err:
-        return {'ok': False, 'msg': 'Error %s<br/> in evaluating your expression "%s"' % (err, given)}
+    except Exception as err:
+        return {'ok': False, 'msg': HTML('Error {err}<br/> in evaluating your expression "{given}"').format(
+            err=err, given=given
+        )}
 
     try:
         xexpect = my_sympify(expect, normphase, matrix, do_qubit=do_qubit, abcsym=abcsym, symtab=symtab)
-    except Exception, err:
-        return {'ok': False, 'msg': 'Error %s<br/> in evaluating OUR expression "%s"' % (err, expect)}
+    except Exception as err:
+        return {'ok': False, 'msg': HTML('Error {err}<br/> in evaluating OUR expression "{expect}"').format(
+            err=err, expect=expect
+        )}
 
     if 'autonorm' in flags:	 # normalize trace of matrices
         try:
             xgiven /= xgiven.trace()
-        except Exception, err:
-            return {'ok': False, 'msg': 'Error %s<br/> in normalizing trace of your expression %s' % (err, to_latex(xgiven))}
+        except Exception as err:
+            return {'ok': False, 'msg': HTML('Error {err}<br/> in normalizing trace of your expression {xgiven}').
+                    format(err=err, xgiven=to_latex(xgiven))}
         try:
             xexpect /= xexpect.trace()
-        except Exception, err:
-            return {'ok': False, 'msg': 'Error %s<br/> in normalizing trace of OUR expression %s' % (err, to_latex(xexpect))}
+        except Exception as err:
+            return {'ok': False, 'msg': HTML('Error {err}<br/> in normalizing trace of OUR expression {xexpect}').
+                    format(err=err, xexpect=to_latex(xexpect))}
 
     msg = 'Your expression was evaluated as ' + to_latex(xgiven)
     # msg += '<br/>Expected ' + to_latex(xexpect)
@@ -144,7 +155,7 @@ def check(expect, given, numerical=False, matrix=False, normphase=False, abcsym=
 
 def make_error_message(msg):
     # msg = msg.replace('<p>','<p><span class="inline-error">').replace('</p>','</span></p>')
-    msg = '<div class="capa_alert">%s</div>' % msg
+    msg = HTML('<div class="capa_alert">{msg}</div>').format(msg=msg)
     return msg
 
 
@@ -208,8 +219,8 @@ def symmath_check(expect, ans, dynamath=None, options=None, debug=None, xml=None
     # parse expected answer
     try:
         fexpect = my_sympify(str(expect), matrix=do_matrix, do_qubit=do_qubit)
-    except Exception, err:
-        msg += '<p>Error %s in parsing OUR expected answer "%s"</p>' % (err, expect)
+    except Exception as err:
+        msg += HTML('<p>Error {err} in parsing OUR expected answer "{expect}"</p>').format(err=err, expect=expect)
         return {'ok': False, 'msg': make_error_message(msg)}
 
     ###### Sympy input #######
@@ -225,18 +236,19 @@ def symmath_check(expect, ans, dynamath=None, options=None, debug=None, xml=None
         if is_within_tolerance(fexpect, fans, threshold):
             return {'ok': True, 'msg': msg}
         else:
-            msg += '<p>You entered: %s</p>' % to_latex(fans)
+            msg += HTML('<p>You entered: {fans}</p>').format(fans=to_latex(fans))
             return {'ok': False, 'msg': msg}
 
     if do_numerical:		# numerical answer expected - force numerical comparison
         if is_within_tolerance(fexpect, fans, threshold):
             return {'ok': True, 'msg': msg}
         else:
-            msg += '<p>You entered: %s (note that a numerical answer is expected)</p>' % to_latex(fans)
+            msg += HTML('<p>You entered: {fans} (note that a numerical answer is expected)</p>').\
+                format(fans=to_latex(fans))
             return {'ok': False, 'msg': msg}
 
     if fexpect == fans:
-        msg += '<p>You entered: %s</p>' % to_latex(fans)
+        msg += HTML('<p>You entered: {fans}</p>').format(fans=to_latex(fans))
         return {'ok': True, 'msg': msg}
 
     ###### PMathML input ######
@@ -254,20 +266,18 @@ def symmath_check(expect, ans, dynamath=None, options=None, debug=None, xml=None
     # if DEBUG: msg += '<p/> mmlans=%s' % repr(mmlans).replace('<','&lt;')
     try:
         fsym = f.sympy
-        msg += '<p>You entered: %s</p>' % to_latex(f.sympy)
-    except Exception, err:
+        msg += HTML('<p>You entered: {sympy}</p>').format(sympy=to_latex(f.sympy))
+    except Exception as err:
         log.exception("Error evaluating expression '%s' as a valid equation", ans)
-        msg += "<p>Error in evaluating your expression '%s' as a valid equation</p>" % (ans)
+        msg += HTML("<p>Error in evaluating your expression '{ans}' as a valid equation</p>").format(ans=ans)
         if "Illegal math" in str(err):
-            msg += "<p>Illegal math expression</p>"
+            msg += HTML("<p>Illegal math expression</p>")
         if DEBUG:
-            msg += 'Error: %s' % str(err).replace('<', '&lt;')
-            msg += '<hr>'
-            msg += '<p><font color="blue">DEBUG messages:</p>'
-            msg += "<p><pre>%s</pre></p>" % traceback.format_exc()
-            msg += '<p>cmathml=<pre>%s</pre></p>' % f.cmathml.replace('<', '&lt;')
-            msg += '<p>pmathml=<pre>%s</pre></p>' % mmlans.replace('<', '&lt;')
-            msg += '<hr>'
+            msg += HTML('Error: {err}<hr><p><font color="blue">DEBUG messages:</p><p><pre>{format_exc}</pre></p>'
+                        '<p>cmathml=<pre>{cmathml}</pre></p><p>pmathml=<pre>{pmathml}</pre></p><hr>').format(
+                err=escape(str(err)), format_exc=traceback.format_exc(), cmathml=escape(f.cmathml),
+                pmathml=escape(mmlans)
+            )
         return {'ok': False, 'msg': make_error_message(msg)}
 
     # do numerical comparison with expected
@@ -276,9 +286,9 @@ def symmath_check(expect, ans, dynamath=None, options=None, debug=None, xml=None
             if abs(abs(fsym - fexpect) / fexpect) < threshold:
                 return {'ok': True, 'msg': msg}
             return {'ok': False, 'msg': msg}
-        msg += "<p>Expecting a numerical answer!</p>"
-        msg += "<p>given = %s</p>" % repr(ans)
-        msg += "<p>fsym = %s</p>" % repr(fsym)
+        msg += HTML("<p>Expecting a numerical answer!</p><p>given = {ans}</p><p>fsym = {fsym}</p>").format(
+            ans=repr(ans), fsym=repr(fsym)
+        )
         # msg += "<p>cmathml = <pre>%s</pre></p>" % str(f.cmathml).replace('<','&lt;')
         return {'ok': False, 'msg': make_error_message(msg)}
 
@@ -296,12 +306,12 @@ def symmath_check(expect, ans, dynamath=None, options=None, debug=None, xml=None
             if abs(dm.vec().norm().evalf()) < threshold:
                 return {'ok': True, 'msg': msg}
         except sympy.ShapeError:
-            msg += "<p>Error - your input vector or matrix has the wrong dimensions"
+            msg += HTML("<p>Error - your input vector or matrix has the wrong dimensions")
             return {'ok': False, 'msg': make_error_message(msg)}
-        except Exception, err:
-            msg += "<p>Error %s in comparing expected (a list) and your answer</p>" % str(err).replace('<', '&lt;')
+        except Exception as err:
+            msg += HTML("<p>Error %s in comparing expected (a list) and your answer</p>").format(escape(str(err)))
             if DEBUG:
-                msg += "<p/><pre>%s</pre>" % traceback.format_exc()
+                msg += HTML("<p/><pre>{format_exc}</pre>").format(format_exc=traceback.format_exc())
             return {'ok': False, 'msg': make_error_message(msg)}
 
     #diff = (fexpect-fsym).simplify()
@@ -313,15 +323,13 @@ def symmath_check(expect, ans, dynamath=None, options=None, debug=None, xml=None
         diff = None
 
     if DEBUG:
-        msg += '<hr>'
-        msg += '<p><font color="blue">DEBUG messages:</p>'
-        msg += "<p>Got: %s</p>" % repr(fsym)
+        msg += HTML('<hr><p><font color="blue">DEBUG messages:</p><p>Got: {fsym}</p><p>Expecting: {fexpect}</p>')\
+            .format(fsym=repr(fsym), fexpect=repr(fexpect).replace('**', '^').replace('hat(I)', 'hat(i)'))
         # msg += "<p/>Got: %s" % str([type(x) for x in fsym.atoms()]).replace('<','&lt;')
-        msg += "<p>Expecting: %s</p>" % repr(fexpect).replace('**', '^').replace('hat(I)', 'hat(i)')
         # msg += "<p/>Expecting: %s" % str([type(x) for x in fexpect.atoms()]).replace('<','&lt;')
         if diff:
-            msg += "<p>Difference: %s</p>" % to_latex(diff)
-        msg += '<hr>'
+            msg += HTML("<p>Difference: {diff}</p>").format(diff=to_latex(diff))
+        msg += HTML('<hr>')
 
     # Used to return more keys: 'ex': fexpect, 'got': fsym
     return {'ok': False, 'msg': msg}
diff --git a/common/static/js/capa/drag_and_drop/base_image.js b/common/static/js/capa/drag_and_drop/base_image.js
index c9114f86c7e5..a06f13f3e170 100644
--- a/common/static/js/capa/drag_and_drop/base_image.js
+++ b/common/static/js/capa/drag_and_drop/base_image.js
@@ -1,21 +1,14 @@
 (function(requirejs, require, define) {
-    define([], function() {
+    define(['edx-ui-toolkit/js/utils/html-utils'], function(HtmlUtils) {
         return BaseImage;
 
         function BaseImage(state) {
             var $baseImageElContainer;
 
-            $baseImageElContainer = $(
-            '<div ' +
-                'class="base_image_container" ' +
-                'style=" ' +
-                    'position: relative; ' +
-                    'margin-bottom: 25px; ' +
-                    'margin-left: auto; ' +
-                    'margin-right: auto; ' +
-                '" ' +
-            '></div>'
-        );
+            $baseImageElContainer = $(HtmlUtils.joinHtml(
+                HtmlUtils.HTML('<div class="base_image_container" style=" position: relative; margin-bottom: 25px; '),
+                HtmlUtils.HTML('margin-left: auto; margin-right: auto; " ></div>')
+            ).toString());
 
             state.baseImageEl = $('<img />', {
                 alt: gettext('Drop target image')
@@ -38,12 +31,13 @@
                 state.baseImageLoaded = true;
             });
             state.baseImageEl.error(function() {
+                var errorMsg = HtmlUtils.joinHtml(
+                    HtmlUtils.HTML('<span style="color: red;">'),
+                        HtmlUtils.HTML('ERROR: Image "'), state.config.baseImage, HtmlUtils.HTML('" was not found!'),
+                    HtmlUtils.HTML('</span>')
+                );
                 console.log('ERROR: Image "' + state.config.baseImage + '" was not found!');
-                $baseImageElContainer.html(
-                '<span style="color: red;">' +
-                    'ERROR: Image "' + state.config.baseImage + '" was not found!' +
-                '</span>'
-            );
+                HtmlUtils.setHtml($baseImageElContainer, errorMsg);
                 $baseImageElContainer.appendTo(state.containerEl);
             });
         }
diff --git a/common/test/test_sites/test_site/templates/static_templates/contact.html b/common/test/test_sites/test_site/templates/static_templates/contact.html
index 3cd9120e9a17..1eec8a2d2978 100644
--- a/common/test/test_sites/test_site/templates/static_templates/contact.html
+++ b/common/test/test_sites/test_site/templates/static_templates/contact.html
@@ -4,6 +4,8 @@
 <%!
 from django.utils.translation import ugettext as _
 from django.urls import reverse
+
+from openedx.core.djangolib.markup import HTML, Text
 %>
 
 <%block name="title"><title>${_("Contact {platform_name}").format(platform_name=settings.PLATFORM_NAME)}</title></%block>
@@ -25,39 +27,40 @@ <h2>${_("Class Feedback")}</h2>
       <p>${_("We are always seeking feedback to improve our courses. If you are an enrolled student and have any questions, feedback, suggestions, or any other issues specific to a particular class, please post on the discussion forums of that class.")}</p>
 
       <h2>${_("General Inquiries and Feedback")}</h2>
-      <p>${_('If you have a general question about {platform_name} please email {email}. To see if your question has already been answered, visit our {faq_link_start}FAQ page{faq_link_end}. You can also join the discussion on our {fb_link_start}facebook page{fb_link_end}. Though we may not have a chance to respond to every email, we take all feedback into consideration.').format(
+      <p>${Text(_('If you have a general question about {platform_name} please email {email}. To see if your question has already been answered, visit our {faq_link_start}FAQ page{faq_link_end}. You can also join the discussion on our {fb_link_start}facebook page{fb_link_end}. Though we may not have a chance to respond to every email, we take all feedback into consideration.')).format(
           platform_name=settings.PLATFORM_NAME,
-          email='<a href="mailto:{contact_email}">{contact_email}</a>'.format(contact_email=settings.CONTACT_EMAIL),
-          faq_link_start='<a href="{url}">'.format(url=reverse('faq_edx')),
-          faq_link_end='</a>',
-          fb_link_start='<a href="http://www.facebook.com/EdxOnline">',
-          fb_link_end='</a>'
+          email=HTML('<a href="mailto:{contact_email}">{contact_email}</a>').format(contact_email=settings.CONTACT_EMAIL),
+          faq_link_start=HTML('<a href="{url}">').format(url=reverse('faq_edx')),
+          faq_link_end=HTML('</a>'),
+          fb_link_start=HTML('<a href="http://www.facebook.com/EdxOnline">'),
+          fb_link_end=HTML('</a>')
         )}</p>
 
       <h2>${_("Technical Inquiries and Feedback")}</h2>
-      <p>${_('If you have suggestions/feedback about the overall {platform_name} platform, or are facing general technical issues with the platform (e.g., issues with email addresses and passwords), you can reach us at {tech_email}. For technical questions, please make sure you are using a current version of Firefox or Chrome, and include browser and version in your e-mail, as well as screenshots or other pertinent details. If you find a bug or other issues, you can reach us at the following: {bug_email}.').format(
+      <p>${Text(_('If you have suggestions/feedback about the overall {platform_name} platform, or are facing general technical issues with the platform (e.g., issues with email addresses and passwords), you can reach us at {tech_email}. For technical questions, please make sure you are using a current version of Firefox or Chrome, and include browser and version in your e-mail, as well as screenshots or other pertinent details. If you find a bug or other issues, you can reach us at the following: {bug_email}.')).format(
         platform_name=settings.PLATFORM_NAME,
-        tech_email='<a href="mailto:{tech_support_email}">{tech_support_email}</a>'.format(tech_support_email=settings.TECH_SUPPORT_EMAIL),
-        bug_email='<a href="mailto:{bugs_email}">{bugs_email}</a>'.format(bugs_email=settings.BUGS_EMAIL)
+        tech_email=HTML('<a href="mailto:{tech_support_email}">{tech_support_email}</a>').format(tech_support_email=settings.TECH_SUPPORT_EMAIL),
+        bug_email=HTML('<a href="mailto:{bugs_email}">{bugs_email}</a>').format(bugs_email=settings.BUGS_EMAIL)
       )}</p>
 
       <h2>${_("Media")}</h2>
-      <p>${_('Please visit our {link_start}media/press page{link_end} for more information. For any media or press inquiries, please email {email}.').format(
-        link_start='<a href="{url}">'.format(url=reverse('faq_edx')),
-        link_end='</a>',
-        email='<a href="mailto:{email}">{email}</a>'.format(email="press@edx.org"),
+      <p>${Text(_('Please visit our {link_start}media/press page{link_end} for more information. For any media or press inquiries, please email {email}.')).format(
+        link_start=HTML('<a href="{url}">').format(url=reverse('faq_edx')),
+        link_end=HTML('</a>'),
+        email=HTML('<a href="mailto:{email}">{email}</a>').format(email="press@edx.org"),
         )}</p>
 
       <h2>${_("Universities")}</h2>
-      <p>${_('If you are a university wishing to collaborate or you have questions about {platform_name}, please email {email}.'.format(
+      <p>${Text(_('If you are a university wishing to collaborate or you have questions about {platform_name}, please email {email}.')).format(
           platform_name="edX",
-          email='<a href="mailto:{email}">{email}</a>'.format(
+          email=HTML('<a href="mailto:{email}">{email}</a>').format(
             email="university@edx.org"
           )
-        ))}</p>
+        )}</p>
 
       <h2>${_("Accessibility")}</h2>
-      <p>${_('{platform_name} strives to create an innovative online-learning platform that promotes accessibility for everyone, including students with disabilities. We are dedicated to improving the accessibility of the platform and welcome your comments or questions at {email}.'.format(platform_name="EdX", email='<a href="mailto:{email}">{email}</a>'.format(email="accessibility@edx.org")))}</p>
+      <p>${Text(_('{platform_name} strives to create an innovative online-learning platform that promotes accessibility for everyone, including students with disabilities. We are dedicated to improving the accessibility of the platform and welcome your comments or questions at {email}.')).format(
+          platform_name="EdX", email=HTML('<a href="mailto:{email}">{email}</a>').format(email="accessibility@edx.org"))}</p>
     </div>
   </section>
 </section>
diff --git a/lms/static/js/instructor_dashboard/student_admin.js b/lms/static/js/instructor_dashboard/student_admin.js
index 083475f879a2..54b773faaae6 100644
--- a/lms/static/js/instructor_dashboard/student_admin.js
+++ b/lms/static/js/instructor_dashboard/student_admin.js
@@ -153,7 +153,7 @@
                     delete_module: false
                 };
                 successMessage = gettext("Success! Problem attempts reset for problem '<%- problem_id %>' and student '<%- student_id %>'.");  // eslint-disable-line max-len
-                errorMessage = gettext("Error resetting problem attempts for problem '<%= problem_id %>' and student '<%- student_id %>'. Make sure that the problem and student identifiers are complete and correct.");  // eslint-disable-line max-len
+                errorMessage = gettext("Error resetting problem attempts for problem '<%- problem_id %>' and student '<%- student_id %>'. Make sure that the problem and student identifiers are complete and correct.");  // eslint-disable-line max-len
                 fullSuccessMessage = _.template(successMessage)({
                     problem_id: problemToReset,
                     student_id: uniqStudentIdentifier

From 62fe7441466a7562ebc28bb5b6a51b5ede9e57c9 Mon Sep 17 00:00:00 2001
From: Samuel Walladge <samuel@opencraft.com>
Date: Tue, 23 Feb 2021 13:53:13 +1030
Subject: [PATCH 2/3] Apply IM patch for xss fixes 8

https://discuss.openedx.org/t/security-im-patch-for-xss-fixes-8/4231
---
 .../js/add-xblock-component-button.underscore | 10 +++---
 .../js/add-xblock-component.underscore        |  2 +-
 .../js/asset-upload-modal.underscore          |  6 ++--
 .../js/course_grade_policy.underscore         | 32 +++++++++----------
 .../js/metadata-dict-entry.underscore         | 12 +++----
 .../js/metadata-option-entry.underscore       | 14 ++++----
 .../js/validation-error-modal.underscore      |  8 ++---
 .../js/verification-access-editor.underscore  |  6 ++--
 .../metadata-translations-item.underscore     | 10 +++---
 .../teams/templates/team-member.underscore    |  6 ++--
 10 files changed, 53 insertions(+), 53 deletions(-)

diff --git a/cms/templates/js/add-xblock-component-button.underscore b/cms/templates/js/add-xblock-component-button.underscore
index 2418746be4d1..cf2e0b6aadd5 100644
--- a/cms/templates/js/add-xblock-component-button.underscore
+++ b/cms/templates/js/add-xblock-component-button.underscore
@@ -1,9 +1,9 @@
 <% if (type === 'advanced' || templates.length > 1) { %>
-<button type="button" class="multiple-templates add-xblock-component-button" data-type="<%= type %>">
+<button type="button" class="multiple-templates add-xblock-component-button" data-type="<%- type %>">
 <% } else { %>
-<button type="button" class="single-template add-xblock-component-button" data-type="<%= type %>" data-category="<%= templates[0].category %>">
+<button type="button" class="single-template add-xblock-component-button" data-type="<%- type %>" data-category="<%- templates[0].category %>">
 <% } %>
-  <span class="large-template-icon large-<%= type %>-icon"></span>
-  <span class="sr"> <%= gettext("Add Component:") %></span>
-  <span class="name"><%= display_name %></span>
+  <span class="large-template-icon large-<%- type %>-icon"></span>
+  <span class="sr"> <%- gettext("Add Component:") %></span>
+  <span class="name"><%- display_name %></span>
 </button>
diff --git a/cms/templates/js/add-xblock-component.underscore b/cms/templates/js/add-xblock-component.underscore
index 9d541e9c33d6..b5d3bc83bea8 100644
--- a/cms/templates/js/add-xblock-component.underscore
+++ b/cms/templates/js/add-xblock-component.underscore
@@ -1,5 +1,5 @@
 <div class="new-component">
-    <h5><%= gettext("Add New Component") %></h5>
+    <h5><%- gettext("Add New Component") %></h5>
     <ul class="new-component-type">
     </ul>
 </div>
diff --git a/cms/templates/js/asset-upload-modal.underscore b/cms/templates/js/asset-upload-modal.underscore
index 17101b032536..f8aee8d0e83d 100644
--- a/cms/templates/js/asset-upload-modal.underscore
+++ b/cms/templates/js/asset-upload-modal.underscore
@@ -1,7 +1,7 @@
 <div class="upload-modal modal" style="display: none;">
-    <a href="#" class="close-button"><span class="icon fa fa-times-circle" aria-hidden="true"></span> <span class="sr"><%= gettext('close') %></span></a>
+    <a href="#" class="close-button"><span class="icon fa fa-times-circle" aria-hidden="true"></span> <span class="sr"><%- gettext('close') %></span></a>
     <div class="modal-body">
-        <h1 class="title"><%= gettext("Upload New File") %></h1>
+        <h1 class="title"><%- gettext("Upload New File") %></h1>
         <p class="file-name">
         <div class="progress-bar">
             <div class="progress-fill"></div>
@@ -12,7 +12,7 @@
         </div>
         <form class="file-chooser" action="asset-url"
               method="post" enctype="multipart/form-data">
-            <a href="#" class="choose-file-button"><%= gettext("Choose File") %></a>
+            <a href="#" class="choose-file-button"><%- gettext("Choose File") %></a>
             <input type="file" class="file-input" name="file">
         </form>
     </div>
diff --git a/cms/templates/js/course_grade_policy.underscore b/cms/templates/js/course_grade_policy.underscore
index 8878378c88aa..ac59928949b0 100644
--- a/cms/templates/js/course_grade_policy.underscore
+++ b/cms/templates/js/course_grade_policy.underscore
@@ -1,35 +1,35 @@
 <li class="field-group course-grading-assignment-list-item">
   <div class="field text" id="field-course-grading-assignment-name">
-  	<label for="course-grading-assignment-name"><%= gettext("Assignment Type Name") %></label>
-  	<input type="text" class="long" id="course-grading-assignment-name" value="<%= model.get('type') %>" />
-  	<span class="tip tip-stacked"><%= gettext("The general category for this type of assignment, for example, Homework or Midterm Exam. This name is visible to learners.") %></span>
+  	<label for="course-grading-assignment-name"><%- gettext("Assignment Type Name") %></label>
+  	<input type="text" class="long" id="course-grading-assignment-name" value="<%= model.get('type') %>" /> <% // xss-lint: disable=underscore-not-escaped %>
+  	<span class="tip tip-stacked"><%- gettext("The general category for this type of assignment, for example, Homework or Midterm Exam. This name is visible to learners.") %></span>
   </div>
 
   <div class="field text" id="field-course-grading-assignment-shortname">
-    <label for="course-grading-assignment-shortname"><%= gettext("Abbreviation") %></label>
-    <input type="text" class="short" id="course-grading-assignment-shortname" value="<%= model.get('short_label') %>" />
-    <span class="tip tip-stacked"><%= gettext("This short name for the assignment type (for example, HW or Midterm) appears next to assignments on a learner's Progress page.") %></span>
+    <label for="course-grading-assignment-shortname"><%- gettext("Abbreviation") %></label>
+    <input type="text" class="short" id="course-grading-assignment-shortname" value="<%= model.get('short_label') %>" /> <% // xss-lint: disable=underscore-not-escaped %>
+    <span class="tip tip-stacked"><%- gettext("This short name for the assignment type (for example, HW or Midterm) appears next to assignments on a learner's Progress page.") %></span>
   </div>
 
   <div class="field text" id="field-course-grading-assignment-gradeweight">
-    <label for="course-grading-assignment-gradeweight"><%= gettext("Weight of Total Grade") %></label>
-    <input type="text" class="short" id="course-grading-assignment-gradeweight" value = "<%= model.get('weight') %>" />
-    <span class="tip tip-stacked"><%= gettext("The weight of all assignments of this type as a percentage of the total grade, for example, 40. Do not include the percent symbol.") %></span>
+    <label for="course-grading-assignment-gradeweight"><%- gettext("Weight of Total Grade") %></label>
+    <input type="text" class="short" id="course-grading-assignment-gradeweight" value = "<%= model.get('weight') %>" /> <% // xss-lint: disable=underscore-not-escaped %>
+    <span class="tip tip-stacked"><%- gettext("The weight of all assignments of this type as a percentage of the total grade, for example, 40. Do not include the percent symbol.") %></span>
   </div>
 
   <div class="field text" id="field-course-grading-assignment-totalassignments">
-    <label for="course-grading-assignment-totalassignments"><%= gettext("Total Number") %></label>
-    <input type="text" class="short" id="course-grading-assignment-totalassignments" value = "<%= model.get('min_count') %>" />
-    <span class="tip tip-stacked"><%= gettext("The number of subsections in the course that contain problems of this assignment type.") %></span>
+    <label for="course-grading-assignment-totalassignments"><%- gettext("Total Number") %></label>
+    <input type="text" class="short" id="course-grading-assignment-totalassignments" value = "<%= model.get('min_count') %>" /> <% // xss-lint: disable=underscore-not-escaped %>
+    <span class="tip tip-stacked"><%- gettext("The number of subsections in the course that contain problems of this assignment type.") %></span>
   </div>
 
   <div class="field text" id="field-course-grading-assignment-droppable">
-    <label for="course-grading-assignment-droppable"><%= gettext("Number of Droppable") %></label>
-    <input type="text" class="short" id="course-grading-assignment-droppable" value = "<%= model.get('drop_count') %>" />
-    <span class="tip tip-stacked"><%= gettext("The number of assignments of this type that will be dropped. The lowest scoring assignments are dropped first.") %></span>
+    <label for="course-grading-assignment-droppable"><%- gettext("Number of Droppable") %></label>
+    <input type="text" class="short" id="course-grading-assignment-droppable" value = "<%= model.get('drop_count') %>" /> <% // xss-lint: disable=underscore-not-escaped %>
+    <span class="tip tip-stacked"><%- gettext("The number of assignments of this type that will be dropped. The lowest scoring assignments are dropped first.") %></span>
   </div>
 
   <div class="actions">
-  	<a href="#" class="button delete-button standard remove-item remove-grading-data"><span class="delete-icon"></span><%= gettext("Delete") %></a>
+  	<a href="#" class="button delete-button standard remove-item remove-grading-data"><span class="delete-icon"></span><%- gettext("Delete") %></a>
   </div>
 </li>
diff --git a/cms/templates/js/metadata-dict-entry.underscore b/cms/templates/js/metadata-dict-entry.underscore
index bc806e2528e4..d3c1e602dfbd 100644
--- a/cms/templates/js/metadata-dict-entry.underscore
+++ b/cms/templates/js/metadata-dict-entry.underscore
@@ -1,14 +1,14 @@
 <div class="wrapper-comp-setting metadata-dict">
-  <label class="label setting-label" for="<%= uniqueId %>"><%= model.get('display_name')%></label>
-  <div id="<%= uniqueId %>" class="wrapper-dict-settings">
+  <label class="label setting-label" for="<%- uniqueId %>"><%- model.get('display_name')%></label>
+  <div id="<%- uniqueId %>" class="wrapper-dict-settings">
     <ol class="list-settings"></ol>
     <a href="#" class="create-action create-setting">
-      <span class="icon fa fa-plus" aria-hidden="true"></span><%= gettext("Add") %> <span class="sr"><%= model.get('display_name')%></span>
+      <span class="icon fa fa-plus" aria-hidden="true"></span><%- gettext("Add") %> <span class="sr"><%- model.get('display_name')%></span>
     </a>
   </div>
-  <button class="action setting-clear inactive" type="button" name="setting-clear" value="<%= gettext("Clear") %>" data-tooltip="<%= gettext("Clear") %>">
+  <button class="action setting-clear inactive" type="button" name="setting-clear" value="<%- gettext("Clear") %>" data-tooltip="<%- gettext("Clear") %>">
     <span class="icon fa fa-undo" aria-hidden="true"></span>
-    <span class="sr">"<%= gettext("Clear Value") %>"</span>
+    <span class="sr">"<%- gettext("Clear Value") %>"</span>
   </button>
 </div>
-<span class="tip setting-help"><%= model.get('help') %></span>
+<span class="tip setting-help"><%- model.get('help') %></span>
diff --git a/cms/templates/js/metadata-option-entry.underscore b/cms/templates/js/metadata-option-entry.underscore
index 71132c66ff01..662c986184cd 100644
--- a/cms/templates/js/metadata-option-entry.underscore
+++ b/cms/templates/js/metadata-option-entry.underscore
@@ -1,16 +1,16 @@
 <div class="wrapper-comp-setting">
-    <label class="label setting-label" for="<%= uniqueId %>"><%= model.get('display_name') %></label>
-    <select class="input setting-input" id="<%= uniqueId %>" name="<%= model.get('display_name') %>">
+    <label class="label setting-label" for="<%- uniqueId %>"><%- model.get('display_name') %></label>
+    <select class="input setting-input" id="<%- uniqueId %>" name="<%- model.get('display_name') %>">
         <% _.each(model.get('options'), function(option) { %>
             <% if (option.display_name !== undefined) { %>
-                <option value="<%= option['display_name'] %>"><%= option['display_name'] %></option>
+                <option value="<%- option['display_name'] %>"><%- option['display_name'] %></option>
             <% } else { %>
-                <option value="<%= option %>"><%= option %></option>
+                <option value="<%- option %>"><%- option %></option>
             <% } %>
         <% }) %>
     </select>
-    <button class="action setting-clear inactive" type="button" name="setting-clear" value="<%= gettext("Clear") %>" data-tooltip="<%= gettext("Clear") %>">
-        <span class="icon fa fa-undo" aria-hidden="true"></span><span class="sr">"<%= gettext("Clear Value") %>"</span>
+    <button class="action setting-clear inactive" type="button" name="setting-clear" value="<%- gettext("Clear") %>" data-tooltip="<%- gettext("Clear") %>">
+        <span class="icon fa fa-undo" aria-hidden="true"></span><span class="sr">"<%- gettext("Clear Value") %>"</span>
     </button>
 </div>
-<span class="tip setting-help"><%= model.get('help') %></span>
+<span class="tip setting-help"><%- model.get('help') %></span>
diff --git a/cms/templates/js/validation-error-modal.underscore b/cms/templates/js/validation-error-modal.underscore
index aff564912ad3..ca661f4fcf75 100644
--- a/cms/templates/js/validation-error-modal.underscore
+++ b/cms/templates/js/validation-error-modal.underscore
@@ -1,7 +1,7 @@
 <div class = "validation-error-modal-content">
     <div class "error-header">
         <p>
-        <%= _.template(
+        <%= _.template( // xss-lint: disable=underscore-not-escaped
             ngettext(
                 "There was {strong_start}{num_errors} validation error{strong_end} while trying to save the course settings in the database.",
                 "There were {strong_start}{num_errors} validation errors{strong_end} while trying to save the course settings in the database.",
@@ -13,7 +13,7 @@
                 num_errors: num_errors,
                 strong_end: '</strong>'
             })%>
-        <%= gettext("Please check the following validation feedbacks and reflect them in your course settings:")%></p>
+        <%- gettext("Please check the following validation feedbacks and reflect them in your course settings:")%></p>
     </div>
 
     <hr>
@@ -24,9 +24,9 @@
             <li class = "error-item">
                 <span class='error-item-title'>
                     <span class="icon fa fa-warning" aria-hidden="true"></span>
-                    <strong><%= value.model.display_name %></strong>:
+                    <strong><%- value.model.display_name %></strong>:
                 </span>
-                <textarea class = "error-item-message" disabled='disabled'><%=value.message%></textarea>
+                <textarea class = "error-item-message" disabled='disabled'><%-value.message%></textarea>
             </li>
 
         <% }); %>
diff --git a/cms/templates/js/verification-access-editor.underscore b/cms/templates/js/verification-access-editor.underscore
index 81f2dc2f462e..1becf73c3220 100644
--- a/cms/templates/js/verification-access-editor.underscore
+++ b/cms/templates/js/verification-access-editor.underscore
@@ -1,6 +1,6 @@
 <form>
   <div role="group" aria-labelledby="verification-checkpoint-title">
-    <h3 id="verification-checkpoint-title" class="modal-section-title"><%= gettext('Verification Checkpoint') %></h3>
+    <h3 id="verification-checkpoint-title" class="modal-section-title"><%- gettext('Verification Checkpoint') %></h3>
     <div class="modal-section-content verification-access">
       <div class="list-fields list-input">
         <div class="field field-checkbox checkbox-cosmetic">
@@ -20,7 +20,7 @@
           </label>
 
           <label class="sr" for="verification-partition-select">
-            <%= gettext('Verification checkpoint to be completed') %>
+            <%- gettext('Verification checkpoint to be completed') %>
           </label>
 
           <select id="verification-partition-select">
@@ -35,7 +35,7 @@
           </select>
 
           <div id="verification-help-text" class="note">
-            <%= gettext("Learners who require verification must pass the selected checkpoint to see the content in this unit. Learners who do not require verification see this content by default.") %>
+            <%- gettext("Learners who require verification must pass the selected checkpoint to see the content in this unit. Learners who do not require verification see this content by default.") %>
           </div>
         </div>
       </div>
diff --git a/cms/templates/js/video/metadata-translations-item.underscore b/cms/templates/js/video/metadata-translations-item.underscore
index cb2fdd23a4bf..9c188fc15de0 100644
--- a/cms/templates/js/video/metadata-translations-item.underscore
+++ b/cms/templates/js/video/metadata-translations-item.underscore
@@ -1,11 +1,11 @@
-<li class="list-settings-item" data-original-lang="<%= originalLang %>">
-  <a href="#" class="remove-action remove-setting" data-value="<%= value %>"><span class="icon fa fa-times-circle" aria-hidden="true"></span><span class="sr"><%= gettext("Remove") %></span></a>
-  <input type="hidden" class="input" value="<%= value %>">
+<li class="list-settings-item" data-original-lang="<%- originalLang %>">
+  <a href="#" class="remove-action remove-setting" data-value="<%- value %>"><span class="icon fa fa-times-circle" aria-hidden="true"></span><span class="sr"><%- gettext("Remove") %></span></a>
+  <input type="hidden" class="input" value="<%- value %>">
   <div class="list-settings-buttons"><% if (newLang) {
-    %><a href="#" class="upload-action upload-setting" data-value="<%= value %>"><%= value ? gettext("Replace") : gettext("Upload") %>
+    %><a href="#" class="upload-action upload-setting" data-value="<%- value %>"><%- value ? gettext("Replace") : gettext("Upload") %>
     </a><%
      } %><% if (value) {
-     %><a href="<%= url %>?language_code=<%= originalLang %>" class="download-action download-setting"><%= gettext("Download") %>
+     %><a href="<%- url %>?language_code=<%- originalLang %>" class="download-action download-setting"><%- gettext("Download") %>
     </a><%
      }
    %>
diff --git a/lms/djangoapps/teams/static/teams/templates/team-member.underscore b/lms/djangoapps/teams/static/teams/templates/team-member.underscore
index f53e4734fb8a..a8e1c02a12b9 100644
--- a/lms/djangoapps/teams/static/teams/templates/team-member.underscore
+++ b/lms/djangoapps/teams/static/teams/templates/team-member.underscore
@@ -1,8 +1,8 @@
 <li>
   <span class="team-member">
-    <a class="member-profile" href="<%= memberProfileUrl %>">
-      <p class="tooltip-custom"><%= username %></p>
-      <img class="image-url" src="<%= imageUrl %>" alt="profile page" />
+    <a class="member-profile" href="<%- memberProfileUrl %>">
+      <p class="tooltip-custom"><%- username %></p>
+      <img class="image-url" src="<%- imageUrl %>" alt="profile page" />
     </a>
   </span>
 </li>

From 65f419832458a30222b4be35cdb4a5956c80b86c Mon Sep 17 00:00:00 2001
From: Samuel Walladge <samuel@opencraft.com>
Date: Tue, 23 Feb 2021 13:54:29 +1030
Subject: [PATCH 3/3] Apply IM patch for xss fixes 9

https://discuss.openedx.org/t/security-im-patch-for-xss-fixes-9/4297
---
 .../js/metadata-file-uploader-entry.underscore   | 10 +++++-----
 cms/templates/js/metadata-list-entry.underscore  | 12 ++++++------
 .../js/metadata-number-entry.underscore          | 10 +++++-----
 .../video/metadata-translations-entry.underscore |  6 +++---
 .../messages/transcripts-choose.underscore       | 16 ++++++++--------
 .../messages/transcripts-found.underscore        | 14 +++++++-------
 .../metadata-videolist-entry.underscore          | 16 ++++++++--------
 .../js/xblock-string-field-editor.underscore     |  8 ++++----
 .../lib/xmodule/xmodule/block_metadata_utils.py  |  4 +++-
 9 files changed, 49 insertions(+), 47 deletions(-)

diff --git a/cms/templates/js/metadata-file-uploader-entry.underscore b/cms/templates/js/metadata-file-uploader-entry.underscore
index a7f2078a240e..af0bd1101fe4 100644
--- a/cms/templates/js/metadata-file-uploader-entry.underscore
+++ b/cms/templates/js/metadata-file-uploader-entry.underscore
@@ -1,9 +1,9 @@
 <div class="wrapper-comp-setting file-uploader">
-  <label class="label setting-label"><%= model.get('display_name') %></label>
-  <input type="hidden" id="<%= uniqueId %>" class="input setting-input" value="<%= model.get("value") %>">
+  <label class="label setting-label"><%- model.get('display_name') %></label>
+  <input type="hidden" id="<%- uniqueId %>" class="input setting-input" value="<%- model.get("value") %>">
   <div class="wrapper-uploader-actions"></div>
-  <button class="action setting-clear inactive" type="button" name="setting-clear" value="<%= gettext("Clear") %>" data-tooltip="<%= gettext("Clear") %>">
-        <span class="icon fa fa-undo" aria-hidden="true"></span><span class="sr">"<%= gettext("Clear Value") %>"</span>
+  <button class="action setting-clear inactive" type="button" name="setting-clear" value="<%- gettext("Clear") %>" data-tooltip="<%- gettext("Clear") %>">
+        <span class="icon fa fa-undo" aria-hidden="true"></span><span class="sr">"<%- gettext("Clear Value") %>"</span>
     </button>
 </div>
-<span class="tip setting-help"><%= model.get('help') %></span>
+<span class="tip setting-help"><%- model.get('help') %></span>
diff --git a/cms/templates/js/metadata-list-entry.underscore b/cms/templates/js/metadata-list-entry.underscore
index 073a5127800f..b37ec383bab1 100644
--- a/cms/templates/js/metadata-list-entry.underscore
+++ b/cms/templates/js/metadata-list-entry.underscore
@@ -1,17 +1,17 @@
 <div class="wrapper-comp-setting metadata-list-enum">
-  <label class="label setting-label" for="<%= uniqueId %>"><%= model.get('display_name')%></label>
-  <div id="<%= uniqueId %>" class="wrapper-list-settings">
+  <label class="label setting-label" for="<%- uniqueId %>"><%- model.get('display_name')%></label>
+  <div id="<%- uniqueId %>" class="wrapper-list-settings">
     <ol class="list-settings">
 
     </ol>
 
     <a href="#" class="create-action create-setting">
-      <span class="icon fa fa-plus" aria-hidden="true"></span><%= gettext("Add") %> <span class="sr"><%= model.get('display_name')%></span>
+      <span class="icon fa fa-plus" aria-hidden="true"></span><%- gettext("Add") %> <span class="sr"><%- model.get('display_name')%></span>
     </a>
   </div>
-  <button class="action setting-clear inactive" type="button" name="setting-clear" value="<%= gettext("Clear") %>" data-tooltip="<%= gettext("Clear") %>">
+  <button class="action setting-clear inactive" type="button" name="setting-clear" value="<%- gettext("Clear") %>" data-tooltip="<%- gettext("Clear") %>">
     <span class="icon fa fa-undo" aria-hidden="true"></span>
-    <span class="sr">"<%= gettext("Clear Value") %>"</span>
+    <span class="sr">"<%- gettext("Clear Value") %>"</span>
   </button>
 </div>
-<span class="tip setting-help"><%= model.get('help') %></span>
+<span class="tip setting-help"><%- model.get('help') %></span>
diff --git a/cms/templates/js/metadata-number-entry.underscore b/cms/templates/js/metadata-number-entry.underscore
index 8621ab528c9c..7f8572e1e8a0 100644
--- a/cms/templates/js/metadata-number-entry.underscore
+++ b/cms/templates/js/metadata-number-entry.underscore
@@ -1,8 +1,8 @@
 <div class="wrapper-comp-setting">
-	<label class="label setting-label" for="<%= uniqueId %>"><%= model.get('display_name') %></label>
-	<input class="input setting-input setting-input-number" type="number" id="<%= uniqueId %>" value='<%= model.get("value") %>'/>
-    <button class="action setting-clear inactive" type="button" name="setting-clear" value="<%= gettext("Clear") %>" data-tooltip="<%= gettext("Clear") %>">
-        <span class="icon fa fa-undo" aria-hidden="true"></span><span class="sr">"<%= gettext("Clear Value") %>"</span>
+	<label class="label setting-label" for="<%- uniqueId %>"><%- model.get('display_name') %></label>
+	<input class="input setting-input setting-input-number" type="number" id="<%- uniqueId %>" value='<%- model.get("value") %>'/>
+    <button class="action setting-clear inactive" type="button" name="setting-clear" value="<%- gettext("Clear") %>" data-tooltip="<%- gettext("Clear") %>">
+        <span class="icon fa fa-undo" aria-hidden="true"></span><span class="sr">"<%- gettext("Clear Value") %>"</span>
     </button>
 </div>
-<span class="tip setting-help"><%= model.get('help') %></span>
+<span class="tip setting-help"><%- model.get('help') %></span>
diff --git a/cms/templates/js/video/metadata-translations-entry.underscore b/cms/templates/js/video/metadata-translations-entry.underscore
index 1afef78cd950..90615f8e4827 100644
--- a/cms/templates/js/video/metadata-translations-entry.underscore
+++ b/cms/templates/js/video/metadata-translations-entry.underscore
@@ -1,11 +1,11 @@
 <div class="wrapper-comp-setting metadata-video-translations">
-  <label class="label setting-label"><%= model.get('display_name')%></label>
+  <label class="label setting-label"><%- model.get('display_name')%></label>
   <input class="upload-transcript-input is-hidden" type="file" name="file" accept=".srt"/>
   <div class="wrapper-translations-settings">
     <ol class="list-settings"></ol>
     <a href="#" class="create-action create-setting">
-      <span class="icon fa fa-plus" aria-hidden="true"></span><%= gettext("Add") %> <span class="sr"><%= model.get('display_name')%></span>
+      <span class="icon fa fa-plus" aria-hidden="true"></span><%- gettext("Add") %> <span class="sr"><%- model.get('display_name')%></span>
     </a>
   </div>
 </div>
-<span class="tip setting-help"><%= model.get('help') %></span>
+<span class="tip setting-help"><%- model.get('help') %></span>
diff --git a/cms/templates/js/video/transcripts/messages/transcripts-choose.underscore b/cms/templates/js/video/transcripts/messages/transcripts-choose.underscore
index d62644396410..f7ae0a4c2132 100644
--- a/cms/templates/js/video/transcripts/messages/transcripts-choose.underscore
+++ b/cms/templates/js/video/transcripts/messages/transcripts-choose.underscore
@@ -1,17 +1,17 @@
 <div class="transcripts-message-status status-error">
     <span class="icon fa fa-remove" aria-hidden="true"></span>
-    <%= gettext("Timed Transcript Conflict") %>
+    <%- gettext("Timed Transcript Conflict") %>
 </div>
 
 <p class="transcripts-message">
-    <%= gettext("The timed transcript for the first video file does not appear to be the same as the timed transcript for the second video file.") %>
+    <%- gettext("The timed transcript for the first video file does not appear to be the same as the timed transcript for the second video file.") %>
     <strong>
-        <%= gettext("Which timed transcript would you like to use?") %>
+        <%- gettext("Which timed transcript would you like to use?") %>
     </strong>
 </p>
 
 <p class="transcripts-error-message is-invisible">
-    <%= gettext("Error.") %>
+    <%- gettext("Error.") %>
 </p>
 
 <div class="wrapper-transcripts-buttons">
@@ -28,12 +28,12 @@
             class="action setting-choose"
             type="button"
             name="setting-choose"
-            data-video-id="<%= value %>"
-            value="<%= message %>"
-            data-tooltip="<%= message %>"
+            data-video-id="<%- value %>"
+            value="<%- message %>"
+            data-tooltip="<%- message %>"
         >
             <span>
-                <%= message %>
+                <%= message %> <% // xss-lint: disable=underscore-not-escaped %>
             </span>
         </button>
     <% }) %>
diff --git a/cms/templates/js/video/transcripts/messages/transcripts-found.underscore b/cms/templates/js/video/transcripts/messages/transcripts-found.underscore
index a803a453f7b6..e42706953b6a 100644
--- a/cms/templates/js/video/transcripts/messages/transcripts-found.underscore
+++ b/cms/templates/js/video/transcripts/messages/transcripts-found.underscore
@@ -1,16 +1,16 @@
-<div class="transcripts-message-status"><span class="icon fa fa-check" aria-hidden="true"></span><%= gettext("Timed Transcript Found") %></div>
+<div class="transcripts-message-status"><span class="icon fa fa-check" aria-hidden="true"></span><%- gettext("Timed Transcript Found") %></div>
 <p class="transcripts-message">
-<%= gettext("EdX has a timed transcript for this video. If you want to edit this transcript, you can download, edit, and re-upload the existing transcript. If you want to replace this transcript, upload a new .srt transcript file.") %>
+<%- gettext("EdX has a timed transcript for this video. If you want to edit this transcript, you can download, edit, and re-upload the existing transcript. If you want to replace this transcript, upload a new .srt transcript file.") %>
 </p>
 <div class="transcripts-file-uploader"></div>
 <p class="transcripts-error-message is-invisible">
-<%= gettext("Error.") %>
+<%- gettext("Error.") %>
 </p>
 <div class="wrapper-transcripts-buttons">
-    <button class="action setting-upload" type="button" name="setting-upload" value="<%= gettext("Upload New Transcript") %>" data-tooltip="<%= gettext("Upload New .srt Transcript") %>">
-        <span><%= gettext("Upload New Transcript") %></span>
+    <button class="action setting-upload" type="button" name="setting-upload" value="<%- gettext("Upload New Transcript") %>" data-tooltip="<%- gettext("Upload New .srt Transcript") %>">
+        <span><%- gettext("Upload New Transcript") %></span>
     </button>
-    <a class="action setting-download" href="/transcripts/download?locator=<%= component_locator %>" data-tooltip="<%= gettext("Download Transcript for Editing") %>">
-        <span><%= gettext("Download Transcript for Editing") %></span>
+    <a class="action setting-download" href="/transcripts/download?locator=<%- component_locator %>" data-tooltip="<%- gettext("Download Transcript for Editing") %>">
+        <span><%- gettext("Download Transcript for Editing") %></span>
     </a>
 </div>
diff --git a/cms/templates/js/video/transcripts/metadata-videolist-entry.underscore b/cms/templates/js/video/transcripts/metadata-videolist-entry.underscore
index 2e0719711b9b..6c22c6f04c99 100644
--- a/cms/templates/js/video/transcripts/metadata-videolist-entry.underscore
+++ b/cms/templates/js/video/transcripts/metadata-videolist-entry.underscore
@@ -1,20 +1,20 @@
 <div class="wrapper-comp-setting metadata-videolist-enum">
-  <label class="label setting-label" for="<%= uniqueId %>"><%= model.get('display_name')%></label>
+  <label class="label setting-label" for="<%- uniqueId %>"><%- model.get('display_name')%></label>
   <div class="wrapper-videolist-settings">
-    <div class="wrapper-videolist-url videolist-settings-item"><input type="text" id="<%= uniqueId %>"  class="input videolist-url" value="<%= model.get('value')[0] %>"></div>
-    <div class="tip videolist-url-tip setting-help"><%= model.get('help') %></div>
+    <div class="wrapper-videolist-url videolist-settings-item"><input type="text" id="<%- uniqueId %>"  class="input videolist-url" value="<%- model.get('value')[0] %>"></div>
+    <div class="tip videolist-url-tip setting-help"><%- model.get('help') %></div>
     <div class="wrapper-videolist-urls">
       <a href="#" class="collapse-action collapse-setting">
-        <span class="icon fa fa-plus" aria-hidden="true"></span><%= gettext("Add URLs for additional versions") %> <span class="sr"><%= model.get('display_name')%></span>
+        <span class="icon fa fa-plus" aria-hidden="true"></span><%- gettext("Add URLs for additional versions") %> <span class="sr"><%- model.get('display_name')%></span>
       </a>
       <div class="videolist-extra-videos">
-        <span class="tip videolist-extra-videos-tip setting-help"><%= gettext("To be sure all students can access the video, we recommend providing both an .mp4 and a .webm version of your video. Click below to add a URL for another version. These URLs cannot be YouTube URLs. The first listed video that's compatible with the student's computer will play.") %></span>
+        <span class="tip videolist-extra-videos-tip setting-help"><%- gettext("To be sure all students can access the video, we recommend providing both an .mp4 and a .webm version of your video. Click below to add a URL for another version. These URLs cannot be YouTube URLs. The first listed video that's compatible with the student's computer will play.") %></span>
         <ol class="videolist-settings">
             <li class="videolist-settings-item">
-              <input type="text" class="input" value="<%= model.get('value')[1] %>">
+              <input type="text" class="input" value="<%- model.get('value')[1] %>">
             </li>
             <li class="videolist-settings-item">
-              <input type="text" class="input" value="<%= model.get('value')[2] %>">
+              <input type="text" class="input" value="<%- model.get('value')[2] %>">
             </li>
         </ol>
       </div>
@@ -22,6 +22,6 @@
   </div>
 </div>
 <div class="transcripts-status is-invisible">
-    <label class="label setting-label transcripts-label"><%= gettext("Default Timed Transcript") %></label>
+    <label class="label setting-label transcripts-label"><%- gettext("Default Timed Transcript") %></label>
     <div class="wrapper-transcripts-message"></div>
 </div>
diff --git a/cms/templates/js/xblock-string-field-editor.underscore b/cms/templates/js/xblock-string-field-editor.underscore
index ced86dfa6538..70ea7b26928b 100644
--- a/cms/templates/js/xblock-string-field-editor.underscore
+++ b/cms/templates/js/xblock-string-field-editor.underscore
@@ -7,10 +7,10 @@
 <div class="xblock-string-field-editor incontext-editor-form">
   <form>
     <% var formLabel = gettext("Edit %(display_name)s (required)"); %>
-    <label><span class="sr"><%= interpolate(formLabel, {display_name: fieldDisplayName}, true) %></span>
-      <input type="text" value="<%= value %>" class="xblock-field-input incontext-editor-input" data-metadata-name="<%= fieldName %>">
+    <label><span class="sr"><%= interpolate(formLabel, {display_name: fieldDisplayName}, true) %></span> <% // xss-lint: disable=underscore-not-escaped %>
+      <input type="text" value="<%= value %>" class="xblock-field-input incontext-editor-input" data-metadata-name="<%- fieldName %>"> <% // xss-lint: disable=underscore-not-escaped %>
     </label>
-    <button class="sr action action-primary" name="submit" type="submit"><%= gettext("Save") %></button>
-    <button class="sr action action-secondary" name="cancel" type="button"><%= gettext("Cancel") %></button>
+    <button class="sr action action-primary" name="submit" type="submit"><%- gettext("Save") %></button>
+    <button class="sr action action-secondary" name="cancel" type="button"><%- gettext("Cancel") %></button>
   </form>
 </div>
diff --git a/common/lib/xmodule/xmodule/block_metadata_utils.py b/common/lib/xmodule/xmodule/block_metadata_utils.py
index acc29055b881..8db6e37bc296 100644
--- a/common/lib/xmodule/xmodule/block_metadata_utils.py
+++ b/common/lib/xmodule/xmodule/block_metadata_utils.py
@@ -6,6 +6,8 @@
 BlockStructure.
 """
 
+from markupsafe import escape
+
 
 def url_name_for_block(block):
     """
@@ -77,4 +79,4 @@ def display_name_with_default_escaped(block):
     # This escaping is incomplete.  However, rather than switching this to use
     # markupsafe.escape() and fixing issues, better to put that energy toward
     # migrating away from this method altogether.
-    return display_name_with_default(block).replace('<', '&lt;').replace('>', '&gt;')
+    return escape(display_name_with_default(block))