fix HTML escaping

src/components/listview/listview.js

@@ -149,7 +149,7 @@ import ServerConnections from '../ServerConnections';
 
             elem.classList.add('listItemBodyText');
 
-            elem.innerHTML = '<bdi>' + text + '</bdi>';
+            elem.innerHTML = '<bdi>' + escapeHtml(text) + '</bdi>';
 
             html += elem.outerHTML;
         }

src/controllers/itemDetails/index.js

@@ -1068,7 +1068,7 @@ function renderTagline(page, item) {
 
     if (item.Taglines && item.Taglines.length) {
         taglineElement.classList.remove('hide');
-        taglineElement.innerHTML = '<bdi>' + item.Taglines[0] + '</bdi>';
+        taglineElement.innerHTML = '<bdi>' + escapeHtml(item.Taglines[0]) + '</bdi>';
     } else {
         taglineElement.classList.add('hide');
     }