From fedd9e040ec10d6be1d4cbb7d2fef69f9b779b53 Mon Sep 17 00:00:00 2001
From: aignatov-bio <47317017+aignatov-bio@users.noreply.github.com>
Date: Wed, 15 Mar 2023 16:04:33 +0100
Subject: [PATCH] Fix escaping for protocol keyword [SCI-8137] (#5147)

---
 app/assets/javascripts/sitewide/dropdown_selector.js | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/app/assets/javascripts/sitewide/dropdown_selector.js b/app/assets/javascripts/sitewide/dropdown_selector.js
index 71e9a23f9..799a25e40 100644
--- a/app/assets/javascripts/sitewide/dropdown_selector.js
+++ b/app/assets/javascripts/sitewide/dropdown_selector.js
@@ -128,7 +128,7 @@ var dropdownSelector = (function() {
   function refreshDropdownSelection(selector, container) {
     container.find('.dropdown-option, .dropdown-group').removeClass('select');
     $.each(getCurrentData(container), function(i, selectedOption) {
-      container.find(`.dropdown-option[data-value="${selectedOption.value}"][data-group="${selectedOption.group || ''}"]`)
+      container.find(`.dropdown-option[data-value="${_.escape(selectedOption.value)}"][data-group="${selectedOption.group || ''}"]`)
         .addClass('select');
     });
     if (selector.data('select-by-group')) {
@@ -736,14 +736,16 @@ var dropdownSelector = (function() {
       var title = (data.params && data.params.tooltip) || $('<span>' + label + '</span>').text().trim();
       // Add new tag before search field
       var tag = $(`<div class="${tagAppearance} ${customClass}" style="${customStyle ? customStyle(data) : ''}" >
-                  <div class="tag-label"
-                    data-ds-tag-group="${data.group}"
-                    data-ds-tag-id="${data.value}">
+                  <div class="tag-label">
                   </div>
                   <i class="fas fa-times ${selector.data('config').singleSelect ? 'hidden' : ''}"></i>
                 </div>`).insertBefore(container.find('.input-field .search-field'));
 
-      tag.find('.tag-label').attr('title', title);
+
+      tag.find('.tag-label')
+        .attr('data-ds-tag-group', data.group)
+        .attr('data-ds-tag-id', data.value)
+        .attr('title', title);
       if (selector.data('config').labelHTML) {
         tag.find('.tag-label').html(label);
       } else {