xss

@@ -135,7 +135,7 @@
                             {{#if pdfUrl}}<a class="invoice-button" href="{{pdfUrl}}">电子发票下载</a>
                             {{/if}}
                             </div>
-                        <p>发票抬头：{{title}}</p>
+                        <p>发票抬头：{{{title}}}</p>
                         {{^}}
                         <p>暂不需要发票
                         {{/if}}

@@ -8,6 +8,7 @@ var $ = require('yoho-jquery');
 
 var yas = require('../../common/data-yas');
 var Dialog = require('../../common/dialog').Dialog;
+var cleanHtml = require('../../../../utils/cleanHtml');
 
 var $invoiceRadio = $('#invoice-radio');
 
@@ -143,7 +144,7 @@ function setShowInvoiceInfo() {
         _h += '电子发票';
     }
 
-    _h += '    ' + invoiceInfo.titleName;
+    _h += '    ' + cleanHtml.htmlEncode(invoiceInfo.titleName);
 
     $dom.removeClass('hide').find('span').html(_h);
 }