XSS injection problem #500
Description
There still persists an xss injection.
Just try to edit tests, and alerts are being thrown. You can see there is added an ESCAPED string, but it is unescaped and placed in DOM as HTML:
beforeEach(function() {
[..]
for (var i = 1; i < 100; i++) {
var $option = $('<option value="' + i + '"><script>alert(1);</script></option>');
[..]
}
[..]
});