Escape some strings
To avoid XSS injection
@@ -54,6 +54,7 @@ import com.google.gwt.event.dom.client.TouchMoveEvent;
import com.google.gwt.event.dom.client.TouchStartEvent;
import com.google.gwt.event.shared.HandlerManager;
import com.google.gwt.event.shared.HandlerRegistration;
+import com.google.gwt.safehtml.shared.SafeHtmlUtils;
import com.google.gwt.user.client.Command;
import com.google.gwt.user.client.DOM;
import com.google.gwt.user.client.DeferredCommand;
@@ -775,7 +776,7 @@ public abstract class MockComponent extends Composite implements PropertyChangeL
// used to get HTML for the iconImage. AbstractImagePrototype requires
// an ImageResource, which we don't necessarily have.
TreeItem itemNode = new TreeItem(
- new HTML("<span>" + iconImage.getElement().getString() + getName() + "</span>")) {
+ new HTML("<span>" + iconImage.getElement().getString() + SafeHtmlUtils.htmlEscapeAllowEntities(getName()) + "</span>")) {
@Override
protected Focusable getFocusable() {
return nullFocusable;
