Tooltip: Escape the title attribute so that it's treated as text and not HTML. Fixes...

diff --git a/demos/autocomplete/combobox.html b/demos/autocomplete/combobox.html
index 8c6f59fc198702c10def85762fe9f23560e53ccc..6229d47b2167b9e2170e317519a6981c18d780cc 100644 (file)
--- a/demos/autocomplete/combobox.html
+++ b/demos/autocomplete/combobox.html
@@ -61,7 +61,7 @@
                                                // remove invalid value, as it didn't match anything
                                                $( element )
                                                        .val( "" )
-                                                       .attr( "title", $( "<a>" ).text( value ).html() + " didn't match any item" )
+                                                       .attr( "title", value + " didn't match any item" )
                                                        .tooltip( "open" );
                                                select.val( "" );
                                                setTimeout(function() {

diff --git a/tests/unit/tooltip/tooltip_options.js b/tests/unit/tooltip/tooltip_options.js
index f9da27fb7431439e11f333d50cb7be124d2ead62..01ac25040884f2c47594faea043e6b8d6848619a 100644 (file)
--- a/tests/unit/tooltip/tooltip_options.js
+++ b/tests/unit/tooltip/tooltip_options.js
@@ -16,6 +16,20 @@ test( "content: default", function() {
        deepEqual( $( "#" + element.data( "ui-tooltip-id" ) ).text(), "anchortitle" );
 });
 
+test( "content: default; HTML escaping", function() {
+       expect( 2 );
+       var scriptText = "<script>$.ui.tooltip.hacked = true;</script>",
+               element = $( "#tooltipped1" );
+
+       $.ui.tooltip.hacked = false;
+       element.attr( "title", scriptText )
+               .tooltip()
+               .tooltip( "open" );
+       equal( $.ui.tooltip.hacked, false, "script did not execute" );
+       deepEqual( $( "#" + element.data( "ui-tooltip-id" ) ).text(), scriptText,
+               "correct tooltip text" );
+});
+
 test( "content: return string", function() {
        expect( 1 );
        var element = $( "#tooltipped1" ).tooltip({

diff --git a/ui/jquery.ui.tooltip.js b/ui/jquery.ui.tooltip.js
index 2ccd61f46c18051cd6ad04893930cc7a44d4075d..ab8d5173c0f58869694fc65cde37d02f05cef879 100644 (file)
--- a/ui/jquery.ui.tooltip.js
+++ b/ui/jquery.ui.tooltip.js
@@ -46,7 +46,9 @@ $.widget( "ui.tooltip", {
        version: "@VERSION",
        options: {
                content: function() {
-                       return $( this ).attr( "title" );
+                       var title = $( this ).attr( "title" );
+                       // Escape title, since we're going from an attribute to raw HTML
+                       return $( "<a>" ).text( title ).html();
                },
                hide: true,
                // Disabled elements have inconsistent behavior across browsers (#8661)