XSS Vulnerability

controllers.application.js

import Ember from 'ember';

export default Ember.Controller.extend({
  appName: 'Ember Twiddle',
  actions : {
    setContent : function(){
      Ember.$("#firstItem").find("span").html(Ember.String.htmlSafe("<img src='kar.jpg' onerror='alert(1);'/>"));
      
      Ember.$("#secondItem").html(Ember.String.htmlSafe("<b>HI</b>"));
    }
  }
  
});

helpers.make-bold.js

import Ember from 'ember';

export function makeBold(params/*, hash*/) {
  return Ember.String.htmlSafe("<b>"+Ember.Handlebars.Utils.escapeExpression(params)+"</b>");
}

export default Ember.Helper.helper(makeBold);

templates.application.hbs

<h1>Encode Html</h1>
<br>
<br>

{{make-bold "<img src='kar.jpg' onerror='alert(1);'/>"}}<br/><br/><br/>
{{make-bold "<span>Text</span>"}}<br/>
{{outlet}}<br/><br/>
<button {{action "setContent"}}>SET</button>
<ul>
	<li id="firstItem">
  	<span>ONE</span>
  </li>
	<li id="secondItem">
    <span>TWO</span>
  </li>
</ul>
<br>
<br>

tests.helpers.destroy-app.js

import Ember from 'ember';

export default function destroyApp(application) {
  Ember.run(application, 'destroy');
}

tests.helpers.resolver.js

import Resolver from '../../resolver';
import config from '../../config/environment';

const resolver = Resolver.create();

resolver.namespace = {
  modulePrefix: config.modulePrefix,
  podModulePrefix: config.podModulePrefix
};

export default resolver;

tests.helpers.start-app.js

import Ember from 'ember';
import Application from '../../app';
import config from '../../config/environment';

const { run } = Ember;
const assign = Ember.assign || Ember.merge;

export default function startApp(attrs) {
  let application;

  let attributes = assign({rootElement: "#test-root"}, config.APP);
  attributes = assign(attributes, attrs); // use defaults, but you can override;

  run(() => {
    application = Application.create(attributes);
    application.setupForTesting();
    application.injectTestHelpers();
  });

  return application;
}

tests.test-helper.js

import resolver from './helpers/resolver';
import {
  setResolver
} from 'ember-qunit';

setResolver(resolver);

twiddle.json

{
  "version": "0.10.6",
  "EmberENV": {
    "FEATURES": {}
  },
  "options": {
    "use_pods": false,
    "enable-testing": false
  },
  "dependencies": {
    "jquery": "https://cdnjs.cloudflare.com/ajax/libs/jquery/1.11.3/jquery.js",
    "ember": "2.9.0",
    "ember-data": "2.9.0",
    "ember-template-compiler": "2.9.0",
    "ember-testing": "2.9.0"
  },
  "addons": {}
}