commit a3471af5f9533513efd60faab5c8475881fc7c62
author Steve McKay <smckay@google.com> Thu Feb 18 16:08:36 2016 -0800
committer Steve McKay <smckay@google.com> Thu Feb 18 16:09:48 2016 -0800
tree 62edccda87c10ace6b8c938d11c2178c10121545
parent 5eb148bab6ea49c4c646649692ae6769b9c4e54c

Escape title of Operationdialog.

Security review feedback.

Bug: 27121721
Change-Id: Ibafa07aea7b2f77ca476e4f62bd5e4e556ba49c7

packages/DocumentsUI/src/com/android/documentsui/OperationDialogFragment.java

diff --git a/packages/DocumentsUI/src/com/android/documentsui/OperationDialogFragment.java b/packages/DocumentsUI/src/com/android/documentsui/OperationDialogFragment.java
index 85cc12b..2cef8d3 100644
--- a/packages/DocumentsUI/src/com/android/documentsui/OperationDialogFragment.java
+++ b/packages/DocumentsUI/src/com/android/documentsui/OperationDialogFragment.java
@@ -16,9 +16,6 @@
 
 package com.android.documentsui;
 
-import static com.android.documentsui.services.FileOperationService.OpType;
-import static com.android.internal.util.Preconditions.checkArgument;
-
 import android.annotation.IntDef;
 import android.app.AlertDialog;
 import android.app.Dialog;
@@ -32,13 +29,11 @@
 import com.android.documentsui.model.DocumentInfo;
 import com.android.documentsui.model.DocumentStack;
 import com.android.documentsui.services.FileOperationService;
-import com.android.documentsui.services.FileOperations;
-import com.android.documentsui.services.Job;
+import com.android.documentsui.services.FileOperationService.OpType;
 
 import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
 import java.util.ArrayList;
-import java.util.List;
 
 /**
  * Alert dialog for operation dialogs.
@@ -114,7 +109,7 @@
 
         final StringBuilder list = new StringBuilder("<p>");
         for (DocumentInfo documentInfo : srcList) {
-            list.append(String.format("&#8226; %s<br>", documentInfo.displayName));
+            list.append(String.format("&#8226; %s<br>", Html.escapeHtml(documentInfo.displayName)));
         }
         list.append("</p>");
         builder.setMessage(Html.fromHtml(String.format(messageFormat, list.toString())));