escape optgroup label (fix snapappointments#1348)

JoshLabs · May 14, 2020 · 9d3a675 · 9d3a675
1 parent e9aa5da
commit 9d3a675
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/js/bootstrap-select.js b/js/bootstrap-select.js
@@ -649,7 +649,7 @@
                 labelSubtext = typeof $parent.data('subtext') !== 'undefined' ? '<small class="text-muted">' + $parent.data('subtext') + '</small>' : '',
                 labelIcon = $parent.data('icon') ? '<span class="' + that.options.iconBase + ' ' + $parent.data('icon') + '"></span> ' : '';
 
-            label = labelIcon + '<span class="text">' + label + labelSubtext + '</span>';
+            label = labelIcon + '<span class="text">' + htmlEscape(label) + labelSubtext + '</span>';
 
             if (index !== 0 && _li.length > 0) { // Is it NOT the first option of the select && are there elements in the dropdown?
               liIndex++;