Fix potential XSS in MultiWordSuggestOracle by properly escaping in setDefaultSuggestionsFromText.
Review at http://gwt-code-reviews.appspot.com/1630804
Review by: jlabanca@google.com
git-svn-id: https://google-web-toolkit.googlecode.com/svn/trunk@10856 8db76d5a-ed1c-0410-87a9-c151d255dfc7
diff --git a/user/src/com/google/gwt/user/client/ui/MultiWordSuggestOracle.java b/user/src/com/google/gwt/user/client/ui/MultiWordSuggestOracle.java
index daa7ad1..a328ac6 100644
--- a/user/src/com/google/gwt/user/client/ui/MultiWordSuggestOracle.java
+++ b/user/src/com/google/gwt/user/client/ui/MultiWordSuggestOracle.java
@@ -16,6 +16,7 @@
package com.google.gwt.user.client.ui;
import com.google.gwt.safehtml.shared.SafeHtmlBuilder;
+import com.google.gwt.safehtml.shared.SafeHtmlUtils;
import com.google.gwt.user.client.rpc.IsSerializable;
import java.util.ArrayList;
@@ -284,7 +285,7 @@
Collection<String> suggestionList) {
Collection<Suggestion> accum = new ArrayList<Suggestion>();
for (String candidate : suggestionList) {
- accum.add(createSuggestion(candidate, candidate));
+ accum.add(createSuggestion(candidate, SafeHtmlUtils.htmlEscape(candidate)));
}
setDefaultSuggestions(accum);
}
