HTML-escape label values in Rickshaw hover-detail.

This commit is contained in:
Julius Volz 2015-03-22 21:59:14 +01:00
parent 942686427d
commit 8f6ef04d70

View file

@ -365,7 +365,7 @@ Prometheus.Graph.prototype.renderLabels = function(labels) {
var labelStrings = []; var labelStrings = [];
for (label in labels) { for (label in labels) {
if (label != "__name__") { if (label != "__name__") {
labelStrings.push("<strong>" + label + "</strong>: " + labels[label]); labelStrings.push("<strong>" + label + "</strong>: " + escapeHTML(labels[label]));
} }
} }
return labels = "<div class=\"labels\">" + labelStrings.join("<br>") + "</div>"; return labels = "<div class=\"labels\">" + labelStrings.join("<br>") + "</div>";