t/lib/QA/TemplateFilters.pm thinks that using $HTMLTags is enough to say you've filtered, but $HTMLTags does no escaping so it isn't enough. You should always either use | html | $HTMLTags or if your string is already escaped use $raw | $HTMLTags to say you've thought about it. The fix to find them is obvious, just remove line 149 so we don't return if we see $HTMLTags, but I don't know how to fix the part that fixes missing filters. Since we've already fixed the cases where we were only using $HTMLTags on a TT variable (as security bugs), what's left is a bunch of strings in koha-tmpl/intranet-tmpl/prog/en/modules/about.tt and a mix of values from koha-conf.xml and the string "127.0.0.1" in koha-tmpl/intranet-tmpl/prog/en/modules/installer/step2.tt The fix for the values from koha-conf.xml is easy, they should be | html filtered. And at first the strings seemed easy to me, just give them | $raw to say we looked at them, but is that right? Is "[% "borrowers" | $HtmlTags tag="strong" %]" done that way to keep that table name from being translatable, so we know it will never need to be escaped?
Nice, the one time I capitalized it correctly was copy-pasted.