LPD-22808 Escape message

Alec-Shay · Apr 12, 2024 · ecd0c9e · ecd0c9e
1 parent 21423cd
commit ecd0c9e
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/...layout-taglib/src/main/java/com/liferay/layout/taglib/servlet/taglib/LayoutCommonTag.java b/...layout-taglib/src/main/java/com/liferay/layout/taglib/servlet/taglib/LayoutCommonTag.java
@@ -15,6 +15,7 @@
 import com.liferay.portal.kernel.servlet.SessionMessages;
 import com.liferay.portal.kernel.theme.ThemeDisplay;
 import com.liferay.portal.kernel.util.GetterUtil;
+import com.liferay.portal.kernel.util.HtmlUtil;
 import com.liferay.portal.kernel.util.PortalUtil;
 import com.liferay.portal.kernel.util.PropsKeys;
 import com.liferay.portal.kernel.util.PropsUtil;
@@ -162,7 +163,7 @@ private String _getScript(String message, String type) {
 		StringBundler sb = new StringBundler(7);
 
 		sb.append("Liferay.Util.openToast({autoClose: 10000, message: '");
-		sb.append(message);
+		sb.append(HtmlUtil.escape(message));
 		sb.append("', title: '");
 		sb.append(LanguageUtil.get(getRequest(), type));
 		sb.append(":', type: '");