Drupal.theme.progressBar() does not escape output correctly

longwave → credited Tom Konda → .

I changed the assigned string in the progress bar id attribute to the escaped strings.
And, I checked the work using javascript similar to the steps to reproduce, no dialog appeared.

The test fails, but it doesn't seem to be related to the changes.
https://git.drupalcode.org/issue/drupal-3426514/-/jobs/1233839#L778

Please review it.

Based on the issue summary seems like something that a test can be written for.

Tagging for issue summary as the proposed solution appears to be empty

Given 🌱 [policy, no patch] Better scoping for bug fix test coverage RTBC I am not sure it is worth the effort of writing a test for this. The fix is trivial and constructing test coverage for it is going to be much more work. The security improvement is minimal - someone explicitly has to inject a weird ID for it to be exploitable - so I think we just fix this and move on, unless anyone disagrees?

nod_ → closed merge request !7315

Committed 1c9e2cf and pushed to 11.x. Thanks!

If it was more serious it wouldn't be public, so +1 to tests not needed.

Automatically closed - issue fixed for 2 weeks with no activity.