This repository has been archived by the owner on Sep 24, 2018. It is now read-only.

Profiler labels don't escape HTML #28

Open

zzzzBov opened this issue Jan 20, 2017 · 0 comments

zzzzBov commented Jan 20, 2017

From source, labels are set with:

<td class="profiler-label"><%= $value.name %></td>

I can't tell if this is meant as a "feature" or whether it's an unintentional bug.

If it's a bug I assume it should be something along the lines of:

<td class="profiler-label"><%= MiniProfiler.safeHtml($value.name) %></td>

The text was updated successfully, but these errors were encountered:

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.