ELEMENTS-1740: HTML Escape Add to Collection label

nuxeo · May 8, 2024 · 7e30492 · 7e30492
1 parent 92e36a2
commit 7e30492
Showing 1 changed file with 5 additions and 3 deletions.
diff --git a/ui/actions/nuxeo-add-to-collection-button.js b/ui/actions/nuxeo-add-to-collection-button.js
@@ -244,18 +244,20 @@ import '../nuxeo-button-styles.js';
       const label = item.displayLabel || item.title;
 
       // if we are adding a new entry with the _newEntryFormatter we don't want to escape the HTML
-      return item.id === -1 ? `<iron-icon icon="nuxeo:add" item-icon></iron-icon>${label}` : escapeHTML(label);
+      return item.id === -1
+        ? `<iron-icon icon="nuxeo:add" item-icon></iron-icon>${escapeHTML(label)}`
+        : escapeHTML(label);
     }
 
     _selectionFormatter(item) {
       const label = item.displayLabel || item.title;
 
       // if we are adding a new entry with the _newEntryFormatter we don't want to escape the HTML
-      return item.id === -1 ? label : escapeHTML(label);
+      return item.id === -1 ? escapeHTML(label) : escapeHTML(label);
     }
 
     _newEntryFormatter(term) {
-      return { id: -1, displayLabel: term };
+      return { id: -1, displayLabel: escapeHTML(term) };
     }
 
     _isValid() {