LPS-195762 Escape NavigationBarTag label

liferay · Oct 4, 2023 · d948e49 · d948e49
1 parent 09318b1
commit d948e49
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/...-clay/src/main/java/com/liferay/frontend/taglib/clay/servlet/taglib/NavigationBarTag.java b/...-clay/src/main/java/com/liferay/frontend/taglib/clay/servlet/taglib/NavigationBarTag.java
@@ -8,6 +8,7 @@
 import com.liferay.frontend.taglib.clay.internal.servlet.taglib.BaseContainerTag;
 import com.liferay.frontend.taglib.clay.servlet.taglib.util.NavigationItem;
 import com.liferay.portal.kernel.feature.flag.FeatureFlagManagerUtil;
+import com.liferay.portal.kernel.util.HtmlUtil;
 import com.liferay.portal.kernel.util.Validator;
 
 import java.util.List;
@@ -138,7 +139,8 @@ protected int processStartTag() throws Exception {
 				}
 
 				jspWriter.write("><span class=\"navbar-text-truncate\">");
-				jspWriter.write((String)navigationItem.get("label"));
+				jspWriter.write(
+					HtmlUtil.escape((String)navigationItem.get("label")));
 				jspWriter.write("</span></a></li>");
 			}