Construct DOM elements using escaping helpers to prevent XSS

1 files changed, 3 insertions, 6 deletions

diff --git a/public/javascripts/related_assets.js b/public/javascripts/related_assets.js
index 803332f..3340fa7 100644
--- a/public/javascripts/related_assets.js
+++ b/public/javascripts/related_assets.js
@@ -15,12 +15,9 @@ related_assets = {
       renderResults: function(data, results) {
         var found = false;
         data.forEach(function(asset) {
-          var item = $(
-            "<a href='#' class='related_asset_result'>" +
-              "<img src='" + asset.thumb_url + "' alt=''>" +
-              "<span>" + asset.name + "</span>" +
-            "</a>"
-          );
+          var item = $("<a>", { href: "#", "class": "related_asset_result" });
+          item.append($("<img>", { src: asset.thumb_url, alt: "" }));
+          item.append($("<span>").text(asset.name || ""));
           item.bind("click", function() {
             related_assets.attach(asset.id, createUrl, list);
             return false;