Encoded HTML in <optgroups> renders html

[ashleydw]

optiongrp labels with encoded html get rendered as html, rather than their the text that should be displayed. <options> themselves work correctly.

I think this is down to the this.parentNode.label call: https://github.com/silviomoreto/bootstrap-select/blob/master/js/bootstrap-select.js#L587

Is there anyway to avoid this? It makes escaping output impossible with the plugin.

Example: https://jsfiddle.net/0kwes0p0/3/

[ashleydw]

The patch for this

- var label = this.parentNode.label,
+ var label = $('<div/>').text(this.parentNode.label).html(),

https://github.com/3floorsup/bootstrap-select/commit/f2ebdf3909c66aea98a3c0bff3e78b5b1e93c255.patch