MDL-49144 blocks: Sanitise alt and title for block controls

BenKelada · Mar 2, 2015 · ead8b28 · ead8b28
1 parent 8721ed5
commit ead8b28
Showing 1 changed file with 23 additions and 5 deletions.
diff --git a/lib/javascript-static.js b/lib/javascript-static.js
@@ -597,14 +597,32 @@ M.util.init_block_hider = function(Y, config) {
                     this.set('block', '#'+this.get('id'));
                     var b = this.get('block'),
                         t = b.one('.title'),
-                        a = null;
+                        a = null,
+                        hide,
+                        show;
                     if (t && (a = t.one('.block_action'))) {
-                        var hide = Y.Node.create('<img class="block-hider-hide" tabindex="0" alt="'+config.tooltipVisible+'" title="'+config.tooltipVisible+'" />');
-                        hide.setAttribute('src', this.get('iconVisible')).on('click', this.updateState, this, true);
+                        hide = Y.Node.create('<img />')
+                            .addClass('block-hider-hide')
+                            .setAttrs({
+                                alt:        config.tooltipVisible,
+                                src:        this.get('iconVisible'),
+                                tabindex:   0,
+                                'title':    config.tooltipVisible
+                            });
                         hide.on('keypress', this.updateStateKey, this, true);
-                        var show = Y.Node.create('<img class="block-hider-show" tabindex="0" alt="'+config.tooltipHidden+'" title="'+config.tooltipHidden+'" />');
-                        show.setAttribute('src', this.get('iconHidden')).on('click', this.updateState, this, false);
+                        hide.on('click', this.updateState, this, true);
+
+                        show = Y.Node.create('<img />')
+                            .addClass('block-hider-show')
+                            .setAttrs({
+                                alt:        config.tooltipHidden,
+                                src:        this.get('iconHidden'),
+                                tabindex:   0,
+                                'title':    config.tooltipHidden
+                            });
                         show.on('keypress', this.updateStateKey, this, false);
+                        show.on('click', this.updateState, this, false);
+
                         a.insert(show, 0).insert(hide, 0);
                     }
                 },