def game_state_is_safe_for_HTML_insertion(status):
    """Return True if input satisfies OWASP XSS Prevention Rule #1."""
    # https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html#rule-1-html-escape-before-inserting-untrusted-data-into-html-element-content"""
    PATTERN = '<div id="finishRound">'
    s = status['game_state'].split(PATTERN)[0]
    if any(c in '''<>'"/''' for c in s):
        return False
    if '&' not in s:
        return True
    amps = s.split('&')
    return all(any(p.startswith(entity) for entity in (
        'amp;', 'lt;', 'gt;', 'quot;', '#x'))
        for p in amps[1:])