twitter/typeahead.js — pull request #990 by sgringwe (2014-09-08 22:59:22+00:00)
Title: remove script,noscript and style tags from suggestions

This pull requests takes the compiled html for the suggestions and removes all scripts, noscripts and style elements. This is useful in cases where the source data is bad (contains javascript injection). Currently with this library, if it were to receive a suggestion such as "", it would inject that into the dom and the alert would be executed.

Caveats: Would no longer allow for purposeful use of those tags in suggestions. Not sure why someone would want to do that though.

Please let me know your thoughts. Maybe this should be configurable instead? Or maybe there is a better place to make this change?