Drupal.theme.progressBar() does not escape output correctly

Problem/Motivation

Originally reported to the Drupal Security Team. We discussed internally and we could find no way to exploit this remotely - the progress bar is controlled from JavaScript or server side PHP - so we agreed this can be fixed in public.

Thanks to Tom Konda for reporting this originally.

Steps to reproduce

You can see this vulnerability by:
1. A developer write following JavaScript code. (This code is based on batch.js)
2. Display any page which loads this library.
3. An alert dialog is appeared.

  // This value is assumed to be retrieved from drupalSettings.
  const paramFromDrupalSettings = `"><img src="#" onerror="alert('XSS');" /></div><div id="mal`;

  const $xssTest = $('#target');
  const pb = new Drupal.ProgressBar(paramFromDrupalSettings);
  $xssTest.empty();
  $xssTest.append(pb.element);

Proposed resolution

Escape the ID in Drupal.theme.progressBar().

Remaining tasks

User interface changes

API changes

Data model changes

Release notes snippet