fix: prevent XSS in tooltip label

2 years ago · e37ce9b99c
parent cdefbb151f
commit e37ce9b99c
1 changed files with 1 additions and 1 deletions
--- a/src/ts/RemoteCursorWidget.ts
+++ b/src/ts/RemoteCursorWidget.ts
@ -75,7 +75,7 @@ export class RemoteCursorWidget implements editor.IContentWidget, IDisposable {
      this._tooltipNode = document.createElement("div");
      this._tooltipNode.className = classNames('monaco-remote-cursor-tooltip', tooltipClassName)
      this._tooltipNode.style.background = color;
-      this._tooltipNode.innerHTML = label;
+      this._tooltipNode.innerText = label;
      this._domNode.appendChild(this._tooltipNode);

      // we only need to listen to scroll positions to update the