Escape user name in filtered search bar

4f51590f · Winnie Hellmann · 4e831152 · 4f51590f
Commit 4f51590f authored Sep 25, 2017 by Winnie Hellmann
Hide whitespace changes
Inline Side-by-side

Showing with 2 additions and 2 deletions

app/assets/javascripts/filtered_search/filtered_search_visual_tokens.js ...ascripts/filtered_search/filtered_search_visual_tokens.js +2 -2

No files found.
--- a/app/assets/javascripts/filtered_search/filtered_search_visual_tokens.js
+++ b/app/assets/javascripts/filtered_search/filtered_search_visual_tokens.js
@@ -123,8 +123,8 @@ class FilteredSearchVisualTokens {
        /* eslint-disable no-param-reassign */
        tokenValueContainer.dataset.originalValue = tokenValue;
        tokenValueElement.innerHTML = `
-          <img class="avatar s20" src="${user.avatar_url}" alt="${user.name}'s avatar">
-          ${user.name}
+          <img class="avatar s20" src="${user.avatar_url}" alt="">
+          ${_.escape(user.name)}
        `;
        /* eslint-enable no-param-reassign */
      })