From ebcc76fa0373c1652512af1fafc92e15f694b80a Mon Sep 17 00:00:00 2001
From: Lawrence Croft <lawrence@ofsystems.com>
Date: Mon, 3 Feb 2020 09:52:45 +1100
Subject: [PATCH] #171 HTML encode <li> element attributes and content

---
 js/ui.multiselect.js | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/js/ui.multiselect.js b/js/ui.multiselect.js
index 2608791..691b7c8 100755
--- a/js/ui.multiselect.js
+++ b/js/ui.multiselect.js
@@ -163,7 +163,14 @@ $.widget("ui.multiselect", {
 	},
 	_getOptionNode: function(option) {
 		option = $(option);
-		var node = $('<li class="ui-state-default ui-element" title="'+option.text()+'" data-selected-value="' + option.val() + '"><span class="ui-icon"/>'+option.text()+'<a href="#" class="action"><span class="ui-corner-all ui-icon"/></a></li>').hide();
+		var node = $('<li>',
+			{
+				class: 'ui-state-default ui-element',
+				title: option.text(),
+				'data-selected-value': option.val()
+			})
+			.append('<span class="ui-icon"/>'+option.html()+'<a href="#" class="action"><span class="ui-corner-all ui-icon"/></a></li>')
+			.hide();
 		node.data('optionLink', option);
 		return node;
 	},