Repository: gogs/gogs
File: public/js/gogs.js (JavaScript)

Code before:
    $menu.find(".item:not(.no-select)").click(function() {
      $(this)
        .parent()
        .find(".item")
        .each(function() {
          $(this).removeClass("selected active");
        });

      $(this).addClass("selected active");
      if (hasUpdateAction) {
        updateIssueMeta($menu.data("update-url"), "", $(this).data("id"));
      }
      switch (input_id) {
        case "#milestone_id":
          var $milestoneAnchor = $('<a class="item"></a>');
          $milestoneAnchor.attr("href", $(this).data("href"));
          $milestoneAnchor.text($(this).text());
          $list.find(".selected").empty().append($milestoneAnchor);
          break;
        case "#assignee_id":
          var $assigneeAnchor = $('<a class="item"></a>');
          $assigneeAnchor.attr("href", $(this).data("href"));
          $assigneeAnchor.append(
            $('<img class="ui avatar image">').attr("src", $(this).data("avatar"))
          );
          $assigneeAnchor.append(document.createTextNode($(this).text()));
          $list.find(".selected").empty().append($assigneeAnchor);
      }
      $(".ui" + select_id + ".list .no-select").addClass("hide");
      $(input_id).val($(this).data("id"));
    });
    $menu.find(".no-select.item").click(function() {
      $(this)
        .parent()
        .find(".item:not(.no-select)")
        .each(function() {
          $(this).removeClass("selected active");
        });

      if (hasUpdateAction) {
        updateIssueMeta($menu.data("update-url"), "", "");
      }

      $list.find(".selected").html("");
      $list.find(".no-select").removeClass("hide");
      $(input_id).val("");
    });
  }

  // Milestone and assignee
  selectItem(".select-milestone", "#milestone_id");

Review comment (security):
Inconsistent API usage: milestone selection uses `.text()` (line 245) while assignee selection uses `document.createTextNode()` for the same purpose. Consider using `.text()` here as well for consistency, as both jQuery's `.text()` and `document.createTextNode()` provide XSS protection but `.text()` maintains consistency with the milestone case.
```suggestion
          $assigneeAnchor.append($("<span></span>").text($(this).text()));
```

Code after:
    $menu.find(".item:not(.no-select)").click(function() {
      $(this)
        .parent()
        .find(".item")
        .each(function() {
          $(this).removeClass("selected active");
        });

      $(this).addClass("selected active");
      if (hasUpdateAction) {
        updateIssueMeta($menu.data("update-url"), "", $(this).data("id"));
      }
      switch (input_id) {
        case "#milestone_id":
          var $milestoneAnchor = $('<a class="item"></a>');
          $milestoneAnchor.attr("href", $(this).data("href"));
          $milestoneAnchor.text($(this).text());
          $list.find(".selected").empty().append($milestoneAnchor);
          break;
        case "#assignee_id":
          var $assigneeAnchor = $('<a class="item"></a>');
          $assigneeAnchor.attr("href", $(this).data("href"));
          $assigneeAnchor.append(
            $('<img class="ui avatar image">').attr("src", $(this).data("avatar"))
          );
          $assigneeAnchor.append($("<span></span>").text($(this).text()));
          $list.find(".selected").empty().append($assigneeAnchor);
      }
      $(".ui" + select_id + ".list .no-select").addClass("hide");
      $(input_id).val($(this).data("id"));
    });
    $menu.find(".no-select.item").click(function() {
      $(this)
        .parent()
        .find(".item:not(.no-select)")
        .each(function() {
          $(this).removeClass("selected active");
        });

      if (hasUpdateAction) {
        updateIssueMeta($menu.data("update-url"), "", "");
      }

      $list.find(".selected").html("");
      $list.find(".no-select").removeClass("hide");
      $(input_id).val("");
    });
  }

  // Milestone and assignee
  selectItem(".select-milestone", "#milestone_id");