github/shiny
1
1
Fork 0
mirror of https://github.com/rstudio/shiny.git synced 2026-04-07 03:00:20 -04:00
Code Issues Packages Projects Releases Wiki Activity

Use jQuery's text() method for proper escaping when inserting data.label string

Browse Source
This commit is contained in:
Carson Sievert
2019-04-30 17:33:26 -05:00
parent 5e8bc204c1
commit a5a0f23c3a
5 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
inst/www/shared/shiny.js
View File

@@ -4338,7 +4338,7 @@ function _defineProperty(obj, key, value) { if (key in obj) { Object.definePrope
if (hasLabelTag) {
labelTag.text(data.label);
} else {
$('<label for="' + $escape(el.id) + '">' + data.label + '</label>').insertBefore(el);
$('<label for="' + $escape(el.id) + '"></label>').text(data.label).insertBefore(el);
}
} else {

2
inst/www/shared/shiny.js.map
View File

File diff suppressed because one or more lines are too long

2
inst/www/shared/shiny.min.js vendored
View File

File diff suppressed because one or more lines are too long

2
inst/www/shared/shiny.min.js.map
View File

File diff suppressed because one or more lines are too long

2
srcjs/input_binding_text.js
View File

@@ -40,7 +40,7 @@ $.extend(textInputBinding, {
if (hasLabelTag) {
labelTag.text(data.label);
} else {
$('<label for="' + $escape(el.id) + '">' + data.label + '</label>').insertBefore(el);
$('<label for="' + $escape(el.id) + '"></label>').text(data.label).insertBefore(el);
}
} else {