From bf110d02d1b8bce26a517043aebca876ee40e5ee Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Torkel=20=C3=96degaard?= <torkel@grafana.com>
Date: Mon, 28 Aug 2017 11:00:42 +0200
Subject: [PATCH] fix: form dropdown, escape autocomplete dropdown items, fixes
 #9089

---
 public/app/core/components/form_dropdown/form_dropdown.ts | 4 +++-
 public/app/plugins/datasource/elasticsearch/query_def.js  | 2 +-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/public/app/core/components/form_dropdown/form_dropdown.ts b/public/app/core/components/form_dropdown/form_dropdown.ts
index 1c611e94397..6e3156df1fc 100644
--- a/public/app/core/components/form_dropdown/form_dropdown.ts
+++ b/public/app/core/components/form_dropdown/form_dropdown.ts
@@ -115,7 +115,9 @@ export class FormDropdownCtrl {
       this.optionCache = options;
 
       // extract texts
-      let optionTexts = _.map(options, 'text');
+      let optionTexts = _.map(options, op => {
+        return _.escape(op.text);
+      });
 
       // add custom values
       if (this.allowCustom) {
diff --git a/public/app/plugins/datasource/elasticsearch/query_def.js b/public/app/plugins/datasource/elasticsearch/query_def.js
index a55e2dfd9e5..080ae8a1cfe 100644
--- a/public/app/plugins/datasource/elasticsearch/query_def.js
+++ b/public/app/plugins/datasource/elasticsearch/query_def.js
@@ -29,7 +29,7 @@ function (_) {
 
     orderByOptions: [
       {text: "Doc Count",  value: '_count' },
-      {text: "Term value", value: '_term' },
+      {text: "Term value<script>alert('hello')</script>", value: '_term' },
     ],
 
     orderOptions: [