Sanitize caption used in Grid header

Cherry pick of #11644
vaadin · Jul 2, 2019 · ca3af82 · ca3af82
1 parent a723b85
commit ca3af82
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/server/src/main/java/com/vaadin/ui/Grid.java b/server/src/main/java/com/vaadin/ui/Grid.java
@@ -38,6 +38,7 @@
 import java.util.logging.Level;
 import java.util.logging.Logger;
 
+import org.jsoup.Jsoup;
 import org.jsoup.nodes.Attributes;
 import org.jsoup.nodes.Element;
 import org.jsoup.select.Elements;
@@ -3424,6 +3425,7 @@ public Column setHeaderCaption(String caption)
             if (caption == null) {
                 caption = ""; // Render null as empty
             }
+            caption = Jsoup.parse(caption).text();
             state.headerCaption = caption;
 
             HeaderRow row = grid.getHeader().getDefaultRow();