From f38bbe57d222efb95126c30edfe5eec2f60020d3 Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Mon, 16 Feb 2026 18:06:19 +0000
Subject: [PATCH 1/2] Fix XSS vulnerability in docs search highlighting

- Implement `escapeHtml` function in `docs/assets/theme.js`
- Update `highlight` function to safely escape content before wrapping matches in `<mark>` tags
- Update `torch/src/todo/TODO_2026-02-16T11:47:38Z.md` to mark task as completed

Co-authored-by: PR0M3TH3AN <53631862+PR0M3TH3AN@users.noreply.github.com>
---
 docs/assets/theme.js                        | 19 ++++++++++++++++++-
 torch/src/todo/TODO_2026-02-16T11:47:38Z.md |  5 +++++
 2 files changed, 23 insertions(+), 1 deletion(-)
 create mode 100644 torch/src/todo/TODO_2026-02-16T11:47:38Z.md

diff --git a/docs/assets/theme.js b/docs/assets/theme.js
index 518779eb..88670fbe 100644
--- a/docs/assets/theme.js
+++ b/docs/assets/theme.js
@@ -46,9 +46,26 @@ document.addEventListener('DOMContentLoaded', () => {
     }
   }
 
+  function escapeHtml(text) {
+    if (!text) return text;
+    return text
+      .replace(/&/g, "&amp;")
+      .replace(/</g, "&lt;")
+      .replace(/>/g, "&gt;")
+      .replace(/"/g, "&quot;")
+      .replace(/'/g, "&#039;");
+  }
+
   function highlight(text, q) {
+    if (!q) return escapeHtml(text);
     const re = new RegExp('(' + q.replace(/[.*+?^${}()|[\\]\\]/g, '\\$&') + ')', 'gi');
-    return text.replace(re, '<mark>$1</mark>');
+    return text.split(re).map((part, index) => {
+      if (index % 2 === 1) {
+        return '<mark>' + escapeHtml(part) + '</mark>';
+      } else {
+        return escapeHtml(part);
+      }
+    }).join('');
   }
 
   searchInput?.addEventListener('input', async e => {
diff --git a/torch/src/todo/TODO_2026-02-16T11:47:38Z.md b/torch/src/todo/TODO_2026-02-16T11:47:38Z.md
new file mode 100644
index 00000000..79240ef3
--- /dev/null
+++ b/torch/src/todo/TODO_2026-02-16T11:47:38Z.md
@@ -0,0 +1,5 @@
+# TODO: bug-reproducer-agent run 2026-02-16T11:47:38Z
+
+- Agent: bug-reproducer-agent
+- Status: Completed
+- Resolution: Fixed XSS vulnerability in docs/assets/theme.js

From 37f8b5acc2e150c7b960830dc098762ecd384954 Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Mon, 16 Feb 2026 18:12:11 +0000
Subject: [PATCH 2/2] Rename TODO file to be Windows compatible

- Rename `torch/src/todo/TODO_2026-02-16T11:47:38Z.md` to `torch/src/todo/TODO_2026-02-16T11-47-38Z.md`
- Removes colons from the filename to fix "invalid path" errors on Windows CI runners

Co-authored-by: PR0M3TH3AN <53631862+PR0M3TH3AN@users.noreply.github.com>
---
 ...{TODO_2026-02-16T11:47:38Z.md => TODO_2026-02-16T11-47-38Z.md} | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 rename torch/src/todo/{TODO_2026-02-16T11:47:38Z.md => TODO_2026-02-16T11-47-38Z.md} (100%)

diff --git a/torch/src/todo/TODO_2026-02-16T11:47:38Z.md b/torch/src/todo/TODO_2026-02-16T11-47-38Z.md
similarity index 100%
rename from torch/src/todo/TODO_2026-02-16T11:47:38Z.md
rename to torch/src/todo/TODO_2026-02-16T11-47-38Z.md