From 71defbf2f92f157faee8fed134a7ffbd74d18e17 Mon Sep 17 00:00:00 2001
From: FreddleSpl0it <patschul@posteo.de>
Date: Mon, 18 Dec 2023 14:02:05 +0100
Subject: [PATCH] escapeHtml in qhandler.js

---
 data/web/js/site/qhandler.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/data/web/js/site/qhandler.js b/data/web/js/site/qhandler.js
index 8a8471f2..34f5d853 100644
--- a/data/web/js/site/qhandler.js
+++ b/data/web/js/site/qhandler.js
@@ -40,7 +40,7 @@ jQuery(function($){
           if (value.score > 0) highlightClass = 'negative';
           else if (value.score < 0) highlightClass = 'positive';
           else highlightClass = 'neutral';
-          $('#qid_detail_symbols').append('<span data-bs-toggle="tooltip" class="rspamd-symbol ' + highlightClass + '" title="' + (value.options ? value.options.join(', ') : '') + '">' + value.name + ' (<span class="score">' + value.score + '</span>)</span>');
+          $('#qid_detail_symbols').append('<span data-bs-toggle="tooltip" class="rspamd-symbol ' + highlightClass + '" title="' + (value.options ? escapeHtml(value.options.join(', ')) : '') + '">' + value.name + ' (<span class="score">' + value.score + '</span>)</span>');
         });
         $('[data-bs-toggle="tooltip"]').tooltip();
       }