From 9aa4a9cb599ae272186b71da593c0f3e184f6773 Mon Sep 17 00:00:00 2001
From: Sohom <sohomdatta1+git@gmail.com>
Date: Fri, 29 Sep 2023 15:47:53 +0200
Subject: [PATCH] Prevent `pagetriage-tags-quickfilter-label` from causing XSS

Bug: T347704
Change-Id: I0aa51ec486001fe136fc0b5364d456c2b48d94da
---
 modules/ext.pageTriage.views.toolbar/ToolView.js | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/modules/ext.pageTriage.views.toolbar/ToolView.js b/modules/ext.pageTriage.views.toolbar/ToolView.js
index f2544fec..4514c66c 100644
--- a/modules/ext.pageTriage.views.toolbar/ToolView.js
+++ b/modules/ext.pageTriage.views.toolbar/ToolView.js
@@ -282,7 +282,9 @@ module.exports = Backbone.View.extend( {
 		return $( '<div>' ).attr( 'id', this.id + '-search' )
 			.addClass( 'mwe-pt-tag-quicksearch' )
 			.append(
-				mw.msg( 'pagetriage-tags-quickfilter-label' ) + ' ',
+				$( '<label>' )
+					.text( mw.msg( 'pagetriage-tags-quickfilter-label' ) )
+					.attr( 'for', this.id + '-search-text' ),
 				$( '<input>' )
 					.attr( { id: this.id + '-search-text',
 						type: 'text' } )
-- 
2.42.0