LGTM.com - false positive

[cdsmith]

Description of the false positive

LGTM complains of an XSS vulnerability due to including user input in a URL. However, I believe the use of encodeURIComponent should address this.

URL to the alert on the project page on LGTM.com

https://lgtm.com/projects/g/google/codeworld/snapshot/8e78087205b2168e4340416885464b313cf25767/files/web/run.html?sort=name&dir=ASC&mode=heatmap#xeb91aa024ab0c6af:1

Thank you for reporting this, @cdsmith. You are right that this is a false positive.
I will put up a fix soon.

(we are tracking this internally as we are discussing a conceptual change to handle this FP properly)

[asger-semmle]

The FP should be fixed by #2216.