From e94291a7c05bb5f806d54badefc494a4a78e1feb Mon Sep 17 00:00:00 2001
From: Dave Lawrence <davmlaw@gmail.com>
Date: Thu, 25 Jun 2026 13:37:10 +0930
Subject: [PATCH] variantopedia: use escapejs for values in inline JS string
 literals

Switch the two values embedded in inline <script> string literals in variant_details.html
from |safe to |escapejs so they are correctly encoded for a JS-string context.
---
 variantopedia/templates/variantopedia/variant_details.html | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/variantopedia/templates/variantopedia/variant_details.html b/variantopedia/templates/variantopedia/variant_details.html
index 1155b22d1..e995ab967 100644
--- a/variantopedia/templates/variantopedia/variant_details.html
+++ b/variantopedia/templates/variantopedia/variant_details.html
@@ -410,14 +410,14 @@
             error: function() {
                 console.log("Error retrieving allele");
                 // Can't retrieve, just show basics
-                let variantString = "{{ variant|safe }}";
+                let variantString = "{{ variant|escapejs }}";
                 let linkData = {variant_string: variantString, variant_coordinate: variantString};
                 populateVariantAllele({link_data: linkData});
             }
         });
     }
 
-    handlePubMedLinks("{{ variant_annotation.pubmed|default_if_none:''|safe }}");
+    handlePubMedLinks("{{ variant_annotation.pubmed|default_if_none:''|escapejs }}");
     let dbSNP = $("#dbsnp_rs_id").text();
     if (dbSNP && dbSNP !== '-') {
         formatField($("#dbsnp_rs_id"), formatDBSNP);