From 3c811c3dda6742b4fe7c3c03a6aabc66cc017648 Mon Sep 17 00:00:00 2001
From: nightwing <amirjanyan@gmail.com>
Date: Tue, 15 Aug 2017 23:31:33 +0400
Subject: [PATCH] fix html escape in upload_progress

---
 plugins/c9.ide.upload/upload_progress.js | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/plugins/c9.ide.upload/upload_progress.js b/plugins/c9.ide.upload/upload_progress.js
index 6e8160f8..2bbdc3aa 100644
--- a/plugins/c9.ide.upload/upload_progress.js
+++ b/plugins/c9.ide.upload/upload_progress.js
@@ -16,6 +16,7 @@ define(function(require, exports, module) {
         var css = require("text!./upload_progress.css");
         var TreeData = require("ace_tree/data_provider");
         var Tree = require("ace_tree/tree");
+        var escapeHTML = require("ace/lib/lang").escapeHTML;
         
         var boxUploadActivityMarkup = require("text!./markup/box_upload_activity.xml");
         
@@ -79,10 +80,10 @@ define(function(require, exports, module) {
             mdlUploadActivity.rowHeightInner = 20;
             mdlUploadActivity.getContentHTML = function(node) {
                 return "<span class='uploadactivity-caption'>"
-                    + node.label
+                    + escapeHTML(node.label)
                     + "</span>"
                     + "<span class='uploadactivity-progress'>"
-                    + (node.progress == undefined ? "&nbsp;" : node.progress + "%") + "</span>"
+                    + (node.progress == undefined ? "&nbsp;" : escapeHTML(node.progress + "%")) + "</span>"
                     + "<span class='uploadactivity-delete'>&nbsp;</span>";
             };
             mdlUploadActivity.updateProgress = function(node, val) {