EasyPro challengePython
Escape HTML
PythonSecurityXSS
The function below wraps user comments in a <div> with no escaping at all.
The bug: a comment containing <script>alert(document.cookie)</script> gets rendered as *actual HTML* — the attacker's JavaScript runs in every visitor's browser, with access to their session cookie.
Your task: fix solve(comments) so every comment is HTML-escaped before being wrapped, using Python's built-in html module.
solve(['hello']) → ['<div>hello</div>']solve(['<script>alert(1)</script>']) → ['<div><script>alert(1)</script></div>']
Sample tests
Test #1Plain text is unaffected
Input: [["hello"]]
Output: ["<div>hello</div>"]
Test #2Script tag is neutralized
Input: [["<script>alert(1)</script>"]]
Output: ["<div><script>alert(1)</script></div>"]
Test #3Ampersand is escaped
Input: [["Tom & Jerry"]]
Output: ["<div>Tom & Jerry</div>"]
Test #4Empty list
Input: [[]]
Output: []