Address code quality issues from PR review

- Add missing 'track' method to signals stub methods array
- Escape single quotes in email values to prevent XSS vulnerabilities
- Improve security of JavaScript string interpolation

Co-Authored-By: Alek <[email protected]>

Author: devin-ai-integration[bot]

pcweb/pages/pricing/header.py

@@ -196,7 +196,7 @@ def submit(self, form_data: dict[str, Any]):
             yield QuoteFormState.send_demo_event(form_data)
 
             yield rx.call_script(
-                f"try {{ signals.identify('{email}'); }} catch(e) {{ console.warn('Signals identify failed:', e); }}"
+                f"try {{ signals.identify('{email.replace("'", "\\'")}'); }} catch(e) {{ console.warn('Signals identify failed:', e); }}"
             )
 
             if self.is_small_company():

pcweb/signup.py

@@ -101,6 +101,6 @@ def signup(
         self.add_contact_to_loops(email)
         self.signed_up = True
         return [
-            rx.call_script(f"try {{ signals.identify('{email}'); }} catch(e) {{ console.warn('Signals identify failed:', e); }}"),
+            rx.call_script(f"try {{ signals.identify('{email.replace("'", "\\'")}'); }} catch(e) {{ console.warn('Signals identify failed:', e); }}"),
             rx.toast.success("Thanks for signing up to the Newsletter!")
         ]

pcweb/telemetry/pixels_signals.py

@@ -11,7 +11,7 @@
   script.async = true;
   window.signals = Object.assign(
     [],
-    ['page', 'identify', 'form'].reduce(function (acc, method){
+    ['page', 'identify', 'form', 'track'].reduce(function (acc, method){
       acc[method] = function () {
         signals.push([method, arguments]);
         return signals;