Escape the item's group_label when rendering it.

harvesthq · Jun 7, 2018 · 5ae77b1 · 5ae77b1
1 parent 053057e
commit 5ae77b1
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/coffee/lib/abstract-chosen.coffee b/coffee/lib/abstract-chosen.coffee
@@ -51,7 +51,7 @@ class AbstractChosen
 
   choice_label: (item) ->
     if @include_group_label_in_selected and item.group_label?
-      "<b class='group-name'>#{item.group_label}</b>#{item.html}"
+      "<b class='group-name'>#{this.escape_html(item.group_label)}</b>#{item.html}"
     else
       item.html