From 5fee6fd5000072ff32f2d65b6451f39af9e0e39e Mon Sep 17 00:00:00 2001
From: Scott González <scott.gonzalez@gmail.com>
Date: Tue, 27 Nov 2012 10:52:19 -0500
Subject: Autocomplete demo: Combobox: Encode search term inside tooltips.
 Fixes #8859 - Autocomplete: XSS in combobox demo.

---
 demos/autocomplete/combobox.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'demos/autocomplete')

diff --git a/demos/autocomplete/combobox.html b/demos/autocomplete/combobox.html
index 6229d47b2..8c6f59fc1 100644
--- a/demos/autocomplete/combobox.html
+++ b/demos/autocomplete/combobox.html
@@ -61,7 +61,7 @@
 						// remove invalid value, as it didn't match anything
 						$( element )
 							.val( "" )
-							.attr( "title", value + " didn't match any item" )
+							.attr( "title", $( "<a>" ).text( value ).html() + " didn't match any item" )
 							.tooltip( "open" );
 						select.val( "" );
 						setTimeout(function() {
-- 
cgit v1.2.3