Fix potential XSS in MultiWordSuggestOracle by properly escaping in setDefaultSuggestionsFromText.

Review at http://gwt-code-reviews.appspot.com/1630804

Review by: jlabanca@google.com

git-svn-id: https://google-web-toolkit.googlecode.com/svn/trunk@10856 8db76d5a-ed1c-0410-87a9-c151d255dfc7

user/src/com/google/gwt/user/client/ui/MultiWordSuggestOracle.java

diff --git a/user/src/com/google/gwt/user/client/ui/MultiWordSuggestOracle.java b/user/src/com/google/gwt/user/client/ui/MultiWordSuggestOracle.java
index daa7ad1..a328ac6 100644
--- a/user/src/com/google/gwt/user/client/ui/MultiWordSuggestOracle.java
+++ b/user/src/com/google/gwt/user/client/ui/MultiWordSuggestOracle.java
@@ -16,6 +16,7 @@
 package com.google.gwt.user.client.ui;
 
 import com.google.gwt.safehtml.shared.SafeHtmlBuilder;
+import com.google.gwt.safehtml.shared.SafeHtmlUtils;
 import com.google.gwt.user.client.rpc.IsSerializable;
 
 import java.util.ArrayList;
@@ -284,7 +285,7 @@
       Collection<String> suggestionList) {
     Collection<Suggestion> accum = new ArrayList<Suggestion>();
     for (String candidate : suggestionList) {
-      accum.add(createSuggestion(candidate, candidate));
+      accum.add(createSuggestion(candidate, SafeHtmlUtils.htmlEscape(candidate)));
     }
     setDefaultSuggestions(accum);
   }