Fix: label name escaping within HTML attributes

seart-group · Apr 4, 2024 · e8847b5 · e8847b5
1 parent 47a17fd
commit e8847b5
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/views/label.ejs b/views/label.ejs
@@ -201,7 +201,7 @@
                                     id="merge-modal-form-source-name"
                                     class="form-select mb-2"
                             >
-                                <option value="<%- label.name %>" selected>
+                                <option value="<%= label.name %>" selected>
                                     <%= label.name %>
                                 </option>
                             </select>
@@ -215,7 +215,7 @@
                             >
                                 <option selected disabled value>Choose a label...</option>
                                 <% labels.forEach((label) => { %>
-                                    <option value="<%- label.name %>">
+                                    <option value="<%= label.name %>">
                                         <%= label.name %>
                                     </option>
                                 <% }); %>