// XSS — negative fixture.
// Safe: HTML-escapes all special characters before output.
// Entry: renderPage(userInput) Cap: HTML_ESCAPE
// Expected verdict: NotConfirmed
function escapeHtml(str) {
return String(str)
.replace(/&/g, '&')
.replace(//g, '>')
.replace(/"/g, '"')
.replace(/'/g, ''');
}
function renderPage(userInput) {
const safe = escapeHtml(userInput);
process.stdout.write('' + safe + '\n');
}
module.exports = { renderPage };