Fix xss in repeatableDeleteButton

janfaracik · Dec 12, 2021 · 59a680b · 59a680b
1 parent 53ac7f0
commit 59a680b
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/core/src/main/resources/lib/form/repeatableDeleteButton.jelly b/core/src/main/resources/lib/form/repeatableDeleteButton.jelly
@@ -32,7 +32,7 @@ THE SOFTWARE.
     </st:attribute>
   </st:documentation>
   <st:adjunct includes="lib.form.repeatable.repeatable"/>
-  <button tooltip="${attrs.value ?: '%Delete'}" class="repeatable-delete danger" type="button">
+  <button tooltip="${h.xmlEscape(attrs.value ?: '%Delete')}" class="repeatable-delete danger" type="button">
     <l:ionicon name="close-outline" />
   </button>
 </j:jelly>