HTML-escape label values in Rickshaw hover-detail.

10 years ago · 8f6ef04d70
parent 942686427d
commit 8f6ef04d70
1 changed files with 1 additions and 1 deletions
--- a/web/static/js/graph.js
+++ b/web/static/js/graph.js
@ -365,7 +365,7 @@ Prometheus.Graph.prototype.renderLabels = function(labels) {
  var labelStrings = [];
  for (label in labels) {
    if (label != "__name__") {
-      labelStrings.push("<strong>" + label + "</strong>: " + labels[label]);
+      labelStrings.push("<strong>" + label + "</strong>: " + escapeHTML(labels[label]));
    }
  }
  return labels = "<div class=\"labels\">" + labelStrings.join("<br>") + "</div>";