single message: use _.escapeHTML(…) around the header's properties

Mithgol · Jul 15, 2014 · 0d442c7 · 0d442c7
1 parent 1c6fb15
commit 0d442c7
Showing 1 changed file with 3 additions and 3 deletions.
diff --git a/script/1message.js b/script/1message.js
@@ -215,7 +215,7 @@ var outputSingleMessage = function(header, callback){
       '<tr>',
          '<th class="inverse">From</th>',
          '<td>',
-            decoded.from || '',
+            _.escapeHTML(decoded.from) || '',
          '</td>',
          '<td class="origAddr">',
             '<i class="fa fa-spinner fa-spin"></i>',
@@ -234,7 +234,7 @@ var outputSingleMessage = function(header, callback){
       '</tr>',
       '<tr>',
          '<th class="inverse">To</th>',
-         '<td>' + (decoded.to     ||'') + '</td>',
+         '<td>' + ( _.escapeHTML(decoded.to) ||'') + '</td>',
          // decoded.toAddr is traditionally ignored outside of netmail:
          '<td></td>', //'<td>' + (decoded.toAddr ||'') + '</td>',
          '<td width=1>',
@@ -252,7 +252,7 @@ var outputSingleMessage = function(header, callback){
       '<tr>',
          '<th class="inverse">Subj</th>',
          '<td colspan=3>',
-            decoded.subj || '',
+            _.escapeHTML(decoded.subj) || '',
          '</td>',
       '</tr>',
       '<tr>',