codesweep errors

app/views/devise/sessions/_session_expiration_warning.html.erb

@@ -20,7 +20,7 @@
         <ul class="application-warnings"></ul>
       </div>
       <div class="modal-footer">
-        <%= link_to l10n(".logout"), destroy_user_session_path, method: "delete", class: "button outline", tabindex: "0" %>
+        <%= h(link_to l10n(".logout"), destroy_user_session_path, method: "delete", class: "button outline", tabindex: "0") %>
         <span tabindex="0", onkeydown="handleButtonKeyDown(event, 'stay-logged-in')", id="stay-logged-in" class="button" data-dismiss="modal"><%= l10n("faa.stay_logged_in") %></span>
       </div>
     </div>

app/views/insured/families/manage_family.html.erb

@@ -7,7 +7,7 @@
         <div class="info-icon icon align-self-start">&nbsp;</div>
         <div class="col px-0 pb-1">
           <p class="mb-1"><%= l10n("insured.qle_detail.eligible_to_enroll_limited_time") %></p>
-          <%= link_to l10n("insured.shop_for_plans"), find_sep_insured_families_path(employee_role_id: @employee_role.try(:id), consumer_role_id: @consumer_role.try(:id), change_plan: @change_plan) %>
+          <%= h(link_to l10n("insured.shop_for_plans"), find_sep_insured_families_path(employee_role_id: @employee_role.try(:id), consumer_role_id: @consumer_role.try(:id), change_plan: @change_plan)) %>
         </div>
       </div>
     </div>
@@ -17,7 +17,7 @@
         <div class="info-icon icon align-self-start">&nbsp;</div>
         <div class="col px-0 pb-1">
           <p class="mb-1"><%= l10n("insured.families.financial_assistance_add_or_remove_family_member") %></p>
-          <%= link_to l10n("insured.families.go_to_applications"), financial_assistance.applications_path %>
+          <%= h(link_to l10n("insured.families.go_to_applications"), financial_assistance.applications_path) %>
         </div>
       </div>
     </div>

app/views/insured/family_members/_dependent_form.html.erb

@@ -163,9 +163,9 @@
             <%= l10n("cancel") %>
             </a>
           <% else %>
-            <%= link_to(insured_family_member_path(dependent), :remote => true, class: 'btn outline mr-2') do %>
+            <%= h(link_to(insured_family_member_path(dependent), :remote => true, class: 'btn outline mr-2') do %>
               <%= l10n("cancel") %>
-            <% end %>
+            <% end) %>
           <% end %>
           <%= f.button(id: 'confirm-member', class: "btn btn-primary hidden", onclick: "$('#btn-continue').removeClass('disabled');") do %>
             <%= l10n("confirm_member") %>

app/views/ui-components/v1/modals/_help_with_plan.html.erb

@@ -58,7 +58,7 @@
           <br>
           <br>
           <ul>
-            <li><%= link_to l10n("insured.plan_shoppings.help_from_a_broker"), benefit_sponsors.staff_index_profiles_broker_agencies_broker_agency_profiles_path, remote: true %></li>
+            <li><%= h(link_to l10n("insured.plan_shoppings.help_from_a_broker"), benefit_sponsors.staff_index_profiles_broker_agencies_broker_agency_profiles_path, remote: true) %></li>
             <% if EnrollRegistry.feature_enabled?(:in_person_assister) %>
               <li><%= h(link_to l10n("insured.plan_shoppings.help_from_an_inperson_assister"), main_app.assister_index_exchanges_hbx_profiles_path, remote: true) %></li>
             <% end %>

components/financial_assistance/app/assets/javascripts/financial_assistance/benefit.js

@@ -106,7 +106,11 @@ document.addEventListener("turbolinks:load", function() {
     var benefitForm = esi == "true" ? document.getElementById('new-benefit-esi-form-' + kind) : document.getElementById('new-benefit-non-esi-form-' + kind);
     var clonedForm = benefitForm.cloneNode(true);
     document.getElementById('add_new_benefit_kind_' + kind).classList.add('hidden');
-    $(clonedForm.querySelector('.insurance-kind-label-container')).html($(document.createElement("h2")).text(selected.innerText.split('$')[0]));
+    var newLabelText = selected.innerText.split('$')[0]
+    var newLabel = document.createElement("h2")
+    newLabel.textContent = newLabelText
+    clonedForm.querySelector('.insurance-kind-label-container').prepend(newLabel);
+    //$(clonedForm.querySelector('.insurance-kind-label-container')).html($(document.createElement("h2")).text(selected.innerText.split('$')[0]));
     clonedForm.querySelector('#benefit_insurance_kind').value = selected.value;
     clonedForm.removeAttribute('id');
     clonedForm.classList.remove('hidden');

components/financial_assistance/app/assets/javascripts/financial_assistance/income.js

@@ -158,8 +158,13 @@ document.addEventListener('turbolinks:load', function () {
         var self = this;
 
         $('#unsavedIncomeChangesWarning').modal('show');
-        $('button#leave').click(function () {
-          window.location.href = $(self).attr('href');
+        $('button#leave').on('click', function() {
+          // these two lines are necessary to prevent the modal from showing again
+          $('.interaction-click-control-continue').removeClass('disabled');
+          $('#nav-buttons a').removeClass('disabled');
+
+          // re-triggering the click as navigating based on the href got flagged in security check
+          self.click();
         });
 
         return false;

components/financial_assistance/app/controllers/financial_assistance/applications_controller.rb

@@ -506,12 +506,10 @@ def generate_income_hash(applicant)
         "#{l10n('faa.incomes.from_employer', assistance_year: assistance_year)}*" => human_boolean(applicant.has_job_income),
         "jobs" => generate_employment_hash(applicant.incomes.jobs),
         l10n('faa.incomes.from_self_employment',
-             assistance_year: FinancialAssistanceRegistry[:enrollment_dates].setting(:application_year).item.constantize.new.call.value!.to_s) => human_boolean(applicant.has_self_employment_income),
+             assistance_year: assistance_year) => human_boolean(applicant.has_self_employment_income),
         l10n('faa.other_incomes.other_sources', assistance_year: assistance_year) => human_boolean(applicant.has_other_income)
       }
-      if FinancialAssistanceRegistry.feature_enabled?(:unemployment_income)
-        income_hash.merge!(l10n('faa.other_incomes.unemployment', assistance_year: assistance_year) => human_boolean(applicant.has_unemployment_income))
-      end
+      income_hash.merge!(l10n('faa.other_incomes.unemployment', assistance_year: assistance_year) => human_boolean(applicant.has_unemployment_income)) if FinancialAssistanceRegistry.feature_enabled?(:unemployment_income)
       income_hash
     end
 

components/financial_assistance/app/views/financial_assistance/applications/_eligibility_results_per_tax_household.html.erb

@@ -151,7 +151,7 @@
 
     <!-- Start: Return to Account Home -->
     <div data-cuke='return_to_account_home' class="my-4">
-      <%= link_to l10n('faa.results.return_to_account_home'), main_app.family_account_path, class: "button secondary" %>
+      <%= h(link_to l10n('faa.results.return_to_account_home'), main_app.family_account_path, class: "button secondary") %>
     </div>
     <!-- End: Return to Account Home -->
 

components/financial_assistance/app/views/financial_assistance/applications/raw_application.yml.erb

@@ -33,7 +33,8 @@
         This person will be claimed as a dependent by: <%= applicant.claimed_as_tax_dependent_by ? @applicants.find(applicant.claimed_as_tax_dependent_by).full_name : nil %>
     INCOME:
     INCOME ADJUSTMENTS:
-        <%= sanitize(l10n('faa.deductions.income_adjustments', subject: l10n('faa.other_ques.this_person'), assistance_year: FinancialAssistanceRegistry[:enrollment_dates].setting(:application_year).item.constantize.new.call.value!.to_s)) %>*: <%= applicant.has_deductions %>
+      <% assistance_year = FinancialAssistance::Operations::EnrollmentDates::ApplicationYear.new.call.value!.to_s %>
+      <%= sanitize(l10n('faa.deductions.income_adjustments', subject: l10n('faa.other_ques.this_person'), assistance_year: assistance_year)) %>*: <%= applicant.has_deductions %>
     HEALTH COVERAGE:
         Is this person currently enrolled in health coverage?: <%= applicant.has_enrolled_health_coverage %>
         Does this person currently have access to other health coverage, including through another person?: <%=applicant.has_eligible_health_coverage %>

components/financial_assistance/app/views/financial_assistance/applications/raw_application_hra.yml.erb

@@ -33,7 +33,8 @@
         This person will be claimed as a dependent by: <%= applicant.claimed_as_tax_dependent_by ? @applicants.find(applicant.claimed_as_tax_dependent_by).full_name : nil %>
     INCOME:
     INCOME ADJUSTMENTS:
-        <%= sanitize(l10n('faa.deductions.income_adjustments', subject: l10n('faa.other_ques.this_person'), assistance_year: FinancialAssistanceRegistry[:enrollment_dates].setting(:application_year).item.constantize.new.call.value!.to_s)) %>*: <%= applicant.has_deductions %>
+      <% assistance_year = FinancialAssistance::Operations::EnrollmentDates::ApplicationYear.new.call.value!.to_s %>
+      <%= sanitize(l10n('faa.deductions.income_adjustments', subject: l10n('faa.other_ques.this_person'), assistance_year: assistance_year)) %>*: <%= applicant.has_deductions %>
     HEALTH COVERAGE:
         Is this person currently enrolled in health coverage or getting help paying for health coverage through a Health Reimbursement Arrangement?: <%= applicant.has_enrolled_health_coverage %>
         <%= FinancialAssistanceRegistry.feature_enabled?(:minimum_value_standard_question) ? 'Does this person currently have access to health coverage or a Health Reimbursement Arrangement that they are not enrolled in?' : 'Does this person currently have access to health coverage or a Health Reimbursement Arrangement that they are not enrolled in (including through another person, like a spouse or parent)?' %>: <%=applicant.has_eligible_health_coverage %>