Ensure warnings are escaped (#6279)

Signed-off-by: David Leadbeater <dgl@dgl.cx>
5 years ago · 129dbdaf74
parent 431844f0a7
commit 129dbdaf74
1 changed files with 1 additions and 1 deletions
--- a/web/ui/static/js/graph/index.js
+++ b/web/ui/static/js/graph/index.js
@ -514,7 +514,7 @@ Prometheus.Graph.prototype.submitQuery = function() {
        }

        if ("warnings" in json && json.warnings.length > 0) {
-          self.showWarning(json.warnings.join('<br>'));
+          self.showWarning(json.warnings.map(escapeHTML).join('<br>'));
        }

        queryHistory.handleHistory(self);