LPS-147397 Escape value attribute of advanced configuration labels

liferay · Feb 18, 2022 · 9e7c85c · 9e7c85c
1 parent d3119ca
commit 9e7c85c
Showing 1 changed file with 4 additions and 4 deletions.
diff --git a/...al-search/portal-search-web/src/main/resources/META-INF/resources/modified/facet/view.jsp b/...al-search/portal-search-web/src/main/resources/META-INF/resources/modified/facet/view.jsp
@@ -89,10 +89,10 @@ ModifiedFacetPortletInstanceConfiguration modifiedFacetPortletInstanceConfigurat
 						for (ModifiedFacetTermDisplayContext modifiedFacetTermDisplayContext : modifiedFacetDisplayContext.getModifiedFacetTermDisplayContexts()) {
 						%>
 
-							<li class="facet-value" name="<%= liferayPortletResponse.getNamespace() + "range_" + modifiedFacetTermDisplayContext.getLabel() %>">
+							<li class="facet-value" name="<%= liferayPortletResponse.getNamespace() + "range_" + HtmlUtil.escape(modifiedFacetTermDisplayContext.getLabel()) %>">
 								<a href="<%= modifiedFacetTermDisplayContext.getRangeURL() %>">
 									<span class="term-name <%= modifiedFacetTermDisplayContext.isSelected() ? "facet-term-selected" : "facet-term-unselected" %>">
-										<liferay-ui:message key="<%= modifiedFacetTermDisplayContext.getLabel() %>" />
+										<liferay-ui:message key="<%= HtmlUtil.escape(modifiedFacetTermDisplayContext.getLabel()) %>" />
 									</span>
 
 									<small class="term-count">
@@ -105,9 +105,9 @@ ModifiedFacetPortletInstanceConfiguration modifiedFacetPortletInstanceConfigurat
 						}
 						%>
 
-						<li class="facet-value" name="<%= liferayPortletResponse.getNamespace() + "range_" + customRangeModifiedFacetTermDisplayContext.getLabel() %>">
+						<li class="facet-value" name="<%= liferayPortletResponse.getNamespace() + "range_" + HtmlUtil.escape(customRangeModifiedFacetTermDisplayContext.getLabel()) %>">
 							<a href="<%= customRangeModifiedFacetTermDisplayContext.getRangeURL() %>" id="<portlet:namespace /><%= customRangeModifiedFacetTermDisplayContext.getLabel() + "-toggleLink" %>">
-								<span class="term-name <%= customRangeModifiedFacetTermDisplayContext.isSelected() ? "facet-term-selected" : "facet-term-unselected" %>"><liferay-ui:message key="<%= customRangeModifiedFacetTermDisplayContext.getLabel() %>" />&hellip;</span>
+								<span class="term-name <%= customRangeModifiedFacetTermDisplayContext.isSelected() ? "facet-term-selected" : "facet-term-unselected" %>"><liferay-ui:message key="<%= HtmlUtil.escape(customRangeModifiedFacetTermDisplayContext.getLabel()) %>" />&hellip;</span>
 
 								<c:if test="<%= customRangeModifiedFacetTermDisplayContext.isSelected() %>">
 									<small class="term-count">