Merge pull request nightscout#7570 from nightscout/wip/bewest/code-ql…

…-analysis codeql text/html injection in food.js
stevebell117 · Oct 1, 2022 · 09c9f81 · 09c9f81
2 parents 74ce49c + dbce9db
commit 09c9f81
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/lib/food/food.js b/lib/food/food.js
@@ -248,7 +248,7 @@ client.init(function loaded () {
           .append($('<span>').addClass('width50px').css('text-align','center').text(foodlist[i].unit))
           .append($('<span>').addClass('width100px').css('text-align','center').append(foodlist[i].carbs))
           .append($('<span>').addClass('width100px').css('text-align','center').append(foodlist[i].gi))
-          .append($('<span>').addClass('width150px').append(foodlist[i].category))
+          .append($('<span>').addClass('width150px').text(foodlist[i].category))
           .append($('<span>').addClass('width150px').text(foodlist[i].subcategory))
           .append($('<span>').addClass('width100px').append(foodlist[i].fat))
           .append($('<span>').addClass('width100px').append(foodlist[i].protein))