From: Juho Nurminen <juho@vaadin.com>
Date: Mon, 3 Feb 2014 14:56:31 +0000 (+0200)
Subject: Added proper escaping to OptionGroup item icon URLs (#13310)
X-Git-Tag: 7.1.12~26
X-Git-Url: https://source.dussan.org/?a=commitdiff_plain;h=d88e4090a14ef3670232ad1b4a83c7260db36f9c;p=vaadin-framework.git

Added proper escaping to OptionGroup item icon URLs (#13310)

Change-Id: Id0dea437e04e829567b31df3e9c496cd5adc09b8
---

diff --git a/client/src/com/vaadin/client/ui/VOptionGroup.java b/client/src/com/vaadin/client/ui/VOptionGroup.java
index fee1c313f5..fe4ef214cb 100644
--- a/client/src/com/vaadin/client/ui/VOptionGroup.java
+++ b/client/src/com/vaadin/client/ui/VOptionGroup.java
@@ -142,8 +142,9 @@ public class VOptionGroup extends VOptionGroupBase implements FocusHandler,
             String icon = opUidl.getStringAttribute("icon");
             if (icon != null && icon.length() != 0) {
                 String iconUrl = client.translateVaadinUri(icon);
-                itemHtml = "<img src=\"" + iconUrl + "\" class=\""
-                        + Icon.CLASSNAME + "\" alt=\"\" />" + itemHtml;
+                itemHtml = "<img src=\"" + Util.escapeAttribute(iconUrl)
+                        + "\" class=\"" + Icon.CLASSNAME + "\" alt=\"\" />"
+                        + itemHtml;
             }
 
             String key = opUidl.getStringAttribute("key");