From 129dbdaf748cac069af85938e01c0a6babbf27e0 Mon Sep 17 00:00:00 2001
From: David Leadbeater <dgl@dgl.cx>
Date: Wed, 6 Nov 2019 07:55:28 +0000
Subject: [PATCH] Ensure warnings are escaped (#6279)

Signed-off-by: David Leadbeater <dgl@dgl.cx>
---
 web/ui/static/js/graph/index.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/web/ui/static/js/graph/index.js b/web/ui/static/js/graph/index.js
index 6128da1d39..e56928a70b 100644
--- a/web/ui/static/js/graph/index.js
+++ b/web/ui/static/js/graph/index.js
@@ -514,7 +514,7 @@ Prometheus.Graph.prototype.submitQuery = function() {
         }
 
         if ("warnings" in json && json.warnings.length > 0) {
-          self.showWarning(json.warnings.join('<br>'));
+          self.showWarning(json.warnings.map(escapeHTML).join('<br>'));
         }
 
         queryHistory.handleHistory(self);