Merge pull request Netflix#921 from xscreach/fix/title-escape

fix(title-xss): escaping text acquired from parameters to avoid any xss attacks
simonhoo · Oct 5, 2015 · 22b7915 · 22b7915
2 parents 54ea927 + aac6929
commit 22b7915
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/hystrix-dashboard/src/main/webapp/monitor/monitor.html b/hystrix-dashboard/src/main/webapp/monitor/monitor.html
@@ -95,9 +95,9 @@ <h2><span id="title_name"></span></h2>
 			}
 
 			if(getUrlVars()["title"] != undefined) {
-				$('#title_name').html("Hystrix Stream: " + decodeURIComponent(getUrlVars()["title"]))
+				$('#title_name').text("Hystrix Stream: " + decodeURIComponent(getUrlVars()["title"]))
 			} else {
-				$('#title_name').html("Hystrix Stream: " + decodeURIComponent(stream))
+				$('#title_name').text("Hystrix Stream: " + decodeURIComponent(stream))
 			}
 
 			//do not show authorization in stream title