From 7a20ee77ad35c36d4824c59e17f88d445f8e5f65 Mon Sep 17 00:00:00 2001
From: Lucas Werkmeister <lucas.werkmeister@wikimedia.de>
Date: Mon, 21 Feb 2022 10:54:08 +0100
Subject: [PATCH] SECURITY: HTML-escape string values

Bug: T302192
---
 includes/JCTabularContentView.php | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/includes/JCTabularContentView.php b/includes/JCTabularContentView.php
index b5aa8fd..87c32ce 100644
--- a/includes/JCTabularContentView.php
+++ b/includes/JCTabularContentView.php
@@ -132,6 +132,8 @@ public function valueToHtml(
 					} elseif ( $column === null ) {
 						$header['class'] = 'mw-tabular-value-null';
 						$column = '';
+					} else {
+						$column = htmlspecialchars( $column );
 					}
 					$vals[] = Html::rawElement( 'td', $header, $column );
 				}
-- 
2.32.0