SSF-21 XSS vulnerability on Measures page

diff --git a/server/sonar-web/src/main/webapp/WEB-INF/app/views/measures/search.html.erb b/server/sonar-web/src/main/webapp/WEB-INF/app/views/measures/search.html.erb
index 397b575f01d21164ec40423338cf6c5750c32a84..168c56d5b9e0e5e439068053761fc53b2fb008c8 100644 (file)
--- a/server/sonar-web/src/main/webapp/WEB-INF/app/views/measures/search.html.erb
+++ b/server/sonar-web/src/main/webapp/WEB-INF/app/views/measures/search.html.erb
@@ -106,8 +106,8 @@
 
 
   var queryParams = [
-    { key: 'qualifiers[]', value: <%= @filter.criteria['qualifiers'].to_json -%> },
-    { key: 'alertLevels[]', value: <%= @filter.criteria['alertLevels'].to_json -%> },
+    { key: 'qualifiers[]', value: <%= json_escape(@filter.criteria['qualifiers'].to_json) -%> },
+    { key: 'alertLevels[]', value: <%= json_escape(@filter.criteria['alertLevels'].to_json) -%> },
     { key: 'fromDate', value: '<%= h @filter.criteria['fromDate'] -%>' },
     { key: 'toDate', value: '<%= h @filter.criteria['toDate'] -%>' },
     { key: 'ageMinDays', value: '<%= h @filter.criteria('ageMinDays') -%>' },