coreui / coreui-pro / 28760966205

95%

Build Type

push

github

Committed by web-flow

Commit Message

fix(pickers,RangeSlider,Autocomplete): route config strings through the sanitizer (#596)

Several developer-config strings were written to innerHTML while skipping the
component's own sanitizer/escaping:
- RangeSlider tooltip update path (init path already sanitized)
- Autocomplete searchNoResultsLabel (multi-select already used textContent)
- TimePicker / DateRangePicker footer buttons and DateRangePicker ranges keys
- Calendar weekNumbersLabel and navigation aria-label attributes

Sanitize (RangeSlider) or set via textContent / HTML-escape (others) so config
can no longer inject markup.

Coverage Stats

2792 of 3080 branches covered (90.65%)

Branch coverage included in aggregate %.

8 of 8 new or added lines in 4 files covered. (100.0%)

1 existing line in 1 file now uncovered.

7177 of 7453 relevant lines covered (96.3%)

726.07 hits per line