From 25e929bb59c8b152b9a244ccf4f3736bcfef476a Mon Sep 17 00:00:00 2001
From: Jason Zimdars <jz@37signals.com>
Date: Thu, 14 Nov 2024 11:04:43 -0600
Subject: [PATCH] Escape param

---
 app/views/bubbles/date_pickers/show.html.erb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/views/bubbles/date_pickers/show.html.erb b/app/views/bubbles/date_pickers/show.html.erb
index 05e7f03a1..5a5756ed5 100644
--- a/app/views/bubbles/date_pickers/show.html.erb
+++ b/app/views/bubbles/date_pickers/show.html.erb
@@ -2,7 +2,7 @@
   <% if @bubble.due_on.present? %>
     <%= form_with model: @bubble, url: bucket_bubble_path(@bubble.bucket, @bubble), data: { controller: "form" } do |form| %>
       <label class="bubble__bubble bubble__meta bubble__date">
-        <%= @bubble.due_on.strftime("%b <br> %d").html_safe %>
+        <%= html_escape @bubble.due_on.strftime("%b <br> %d").html_safe %>
         <%= form.date_field :due_on, class: "input input--hidden", data: { action: "change->form#submit click->form#showPicker" } %>
         <span class="for-screen-reader">Change the due date</span>
       </label>