Escape HTML in hint template parameters

1 files changed, 4 insertions, 2 deletions

diff --git a/js/codeq/hint.js b/js/codeq/hint.js
index a94f571..d090c4d 100644
--- a/js/codeq/hint.js
+++ b/js/codeq/hint.js
@@ -35,7 +35,9 @@
                 if (!args)
                     return template;
                 return template.replace(/\[%=(\w+)%\]/g, function(match, name) {
-                    return args[name];
+                    return args[name].replace(/&/g, '&amp')
+                                     .replace(/</g, '&lt;')
+                                     .replace(/>/g, '&gt;');
                 });
             },
 
@@ -181,4 +183,4 @@
             }
         };
     };
-})();
\ No newline at end of file
+})();