# Task: Detect XSS Vulnerabilities in HTML Templates

Analyze the HTML template files in `workspace/templates/` for cross-site scripting (XSS) vulnerabilities.

## Requirements

1. Examine all `.html` files in `workspace/templates/`.
2. Identify XSS vulnerabilities including:
   - Unescaped variable output (using `{{{ }}}` or `|safe` filter or raw output)
   - Variables used in `href`, `src`, or event handler attributes without sanitization
   - Inline JavaScript using template variables
   - Direct DOM injection patterns
3. Write `workspace/xss_report.json` as a JSON array of objects, each with:
   - `file`: template filename
   - `line`: line number
   - `type`: one of `"unescaped_output"`, `"attribute_injection"`, `"inline_js"`, `"dom_injection"`
   - `description`: explanation of the vulnerability
   - `severity`: `"high"`, `"medium"`, or `"low"`

## Notes

- There are 5 HTML files with a total of 6 XSS vulnerabilities.
- Look for Jinja2/Mustache-style template syntax.

## Output

Save results to `workspace/xss_report.json`.
