Read title value as text instead of HTML

Using `.html` when grabbing the `title` value allows it to be evaluated by JavaScript, a potential security loophole.

diff --git a/js/foundation/foundation.tooltip.js b/js/foundation/foundation.tooltip.js
index d6cb3f638c4455908890bbced139b8a635bb42ac..e5cba11f381d317ddd22da38c76aebc0292ca93a 100644 (file)
--- a/js/foundation/foundation.tooltip.js
+++ b/js/foundation/foundation.tooltip.js
@@ -194,7 +194,7 @@
         tip_template = window[settings.tip_template];
       }
 
-      var $tip = $(tip_template(this.selector($target), $('<div></div>').html($target.attr('title')).html())),
+      var $tip = $(tip_template(this.selector($target), $('<div></div>').html($target.attr('title')).text())),
           classes = this.inheritable_classes($target);
 
       $tip.addClass(classes).appendTo(settings.append_to);