Fix script injection by using _.template escaping

archerli · Nov 21, 2016 · 75cdda9 · 75cdda9
1 parent 3fbc684
commit 75cdda9
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/src/icons.html b/src/icons.html
@@ -57,7 +57,7 @@
     {% include icons/medical.html %}
   </div>
   <script type="text/template" id="results-template">
-    <h2 class="page-header">Search for '<span class="text-color-default"><%= content.query %></span>'</h2>
+    <h2 class="page-header">Search for '<span class="text-color-default"><%- content.query %></span>'</h2>
     <% if (content.nbHits > 0) { %>
       <div class="row fontawesome-icon-list">
         <%= results %>