Fixed xss lint issues

PROD-1609
PROD-1610
PROD-1614
PROD-1615
PROD-1616

cms/static/js/views/utils/create_course_utils.js

@@ -5,7 +5,8 @@ define(['jquery', 'gettext', 'common/js/components/utils/view_utils', 'js/views/
     function($, gettext, ViewUtils, CreateUtilsFactory) {
         'use strict';
         return function(selectors, classes) {
-            var keyLengthViolationMessage = gettext('The combined length of the organization, course number, and course run fields cannot be more than <%=limit%> characters.');
+            var keyLengthViolationMessage = gettext('The combined length of the organization, course number, ' +
+              'and course run fields cannot be more than <%- limit %> characters.');
             var keyFieldSelectors = [selectors.org, selectors.number, selectors.run];
             var nonEmptyCheckFieldSelectors = [selectors.name, selectors.org, selectors.number, selectors.run];
 

cms/static/js/views/utils/create_library_utils.js

@@ -5,7 +5,8 @@ define(['jquery', 'gettext', 'common/js/components/utils/view_utils', 'js/views/
     function($, gettext, ViewUtils, CreateUtilsFactory) {
         'use strict';
         return function(selectors, classes) {
-            var keyLengthViolationMessage = gettext('The combined length of the organization and library code fields cannot be more than <%=limit%> characters.');
+            var keyLengthViolationMessage = gettext('The combined length of the organization and library code fields' +
+              ' cannot be more than <%- limit %> characters.');
             var keyFieldSelectors = [selectors.org, selectors.number];
             var nonEmptyCheckFieldSelectors = [selectors.name, selectors.org, selectors.number];
 

lms/templates/commerce/provider.underscore

 <div class="provider-wrapper">
   <div class="provider-info">
-    <%= interpolate(
-          gettext("You still need to visit the %(display_name)s website to complete the credit process."),
-          { display_name: display_name }, true
-        ) %>
+    <%- edx.StringUtils.interpolate(
+          gettext("You still need to visit the {display_name} website to complete the credit process."),
+          { display_name: display_name })
+          %>
   </div>
   <div class="provider-more-info">
-    <%= interpolate(
-          gettext("To finalize course credit, %(display_name)s requires %(platform_name)s learners to submit a credit request."),
-          { display_name: display_name, platform_name: platformName }, true
-        ) %>
+    <%- edx.StringUtils.interpolate(
+          gettext("To finalize course credit, {display_name} requires {platform_name} learners to submit a credit request."),
+          { display_name: display_name, platform_name: platformName })
+          %>
   </div>
   <div class="provider-instructions">
-    <%= fulfillment_instructions %>
+    <%- fulfillment_instructions %>
   </div>
 </div>
 
 <div class="provider-buttons-logos">
   <div class="provider-logo">
-    <%= interpolate("<img src='%s' alt='%s'></image>", [thumbnail_url, display_name]) %>
+    <%= edx.HtmlUtils.interpolateHtml(
+                edx.HtmlUtils.HTML('<img src="{thumbnailUrl}" alt="{displayName}"></image>'),
+                {thumbnailUrl:thumbnail_url ,displayName:display_name})
+                %>
   </div>
   <div class="complete-order">
-    <%= interpolate('<button data-provider="%s" data-course-key="%s" data-username="%s" class="complete-course" onClick=completeOrder(this)>%s</button>', [id, course_key, username,
-        gettext( "Get Credit")]) %>
+    <%= edx.HtmlUtils.interpolateHtml(
+                edx.HtmlUtils.HTML('<button data-provider="{id}" data-course-key="{courseKey}" data-username="{userName}" class="complete-course" onClick=completeOrder(this)>{credit}</button>'),
+                {id:id, courseKey:course_key, userName:username, credit:gettext( "Get Credit")})
+                %>
   </div>
 </div>

lms/templates/commerce/receipt.underscore

 <div class="wrapper-content-main payment-confirmation-step">
   <article class="content-main">
     <h3 class="title">
-      <%= interpolate(
-            gettext( "Thank you %(full_name)s! We have received your payment for %(course_name)s."),
-            { course_name: "<span class='course_name_placeholder'></span>",
-              full_name: "<span class='full_name_placeholder'></span>"}, true
-          ) %>
+      <%= edx.HtmlUtils.interpolateHtml(
+            gettext( "Thank you {full_name}! We have received your payment for {course_name}."),
+            {
+              course_name: edx.HtmlUtils.HTML("<span class='course_name_placeholder'></span>"),
+              full_name: edx.HtmlUtils.HTML("<span class='full_name_placeholder'></span>")
+              })
+              %>
     </h3>
 
     <% if ( receipt ) { %>

lms/templates/components/header/header.underscore

@@ -4,7 +4,7 @@
         <% if (breadcrumbs !== null && breadcrumbs.length > 0) { %>
             <nav class="breadcrumbs" aria-label="<%- nav_aria_label %>">
             <% _.each(breadcrumbs, function (breadcrumb) { %>
-                <a class="nav-item" href="<%= breadcrumb.url %>"><%- breadcrumb.title %></a>
+                <a class="nav-item" href="<%- breadcrumb.url %>"><%- breadcrumb.title %></a>
                 <span class="icon fa-angle-right" aria-hidden="true"></span>
             <% }) %>
             </nav>