ELEMENTS-1740: HTML Escape Add to Collection label

nuxeo · May 9, 2024 · bdcebe0 · bdcebe0
1 parent 2486c62
commit bdcebe0
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/ui/actions/nuxeo-add-to-collection-button.js b/ui/actions/nuxeo-add-to-collection-button.js
@@ -255,7 +255,7 @@ import '../nuxeo-button-styles.js';
     }
 
     _newEntryFormatter(term) {
-      return { id: -1, displayLabel: term };
+      return { id: -1, displayLabel: escapeHTML(term) };
     }
 
     _isValid() {