diff --git a/src/main/scala/gitbucket/core/service/RepositoryService.scala b/src/main/scala/gitbucket/core/service/RepositoryService.scala
index 20448c8..5997629 100644
--- a/src/main/scala/gitbucket/core/service/RepositoryService.scala
+++ b/src/main/scala/gitbucket/core/service/RepositoryService.scala
@@ -537,10 +537,6 @@
 
       (id, path.substring(id.length).stripPrefix("/"))
     }
-
-//    def getReleaseByTag(tag: String)(implicit s: Session): Option[Release] = {
-//      Releases filter (_.byTag(owner, name, tag)) firstOption
-//    }
   }
 
   def httpUrl(owner: String, name: String)(implicit context: Context): String = s"${context.baseUrl}/git/${owner}/${name}.git"
diff --git a/src/main/twirl/gitbucket/core/releases/form.scala.html b/src/main/twirl/gitbucket/core/releases/form.scala.html
index 7dacfab..1e09891 100644
--- a/src/main/twirl/gitbucket/core/releases/form.scala.html
+++ b/src/main/twirl/gitbucket/core/releases/form.scala.html
@@ -75,9 +75,9 @@
     success: function(file, id) {
       var attach =
         '<li><a href="@context.baseUrl/@repository.owner/@repository.name/_release/@helpers.encodeRefName(tag)/' + id + '">' +
-        '<i class="octicon octicon-file"></i>' + file.name + '</a>' +
+        '<i class="octicon octicon-file"></i>' + escapeHtml(file.name) + '</a>' +
         '<a href="#" class="remove pull-right" style="padding-top: 0px;">(remove)</a>' +
-        '<input type="hidden" name="file:' + id + '" value="' + file.name + '"/>' + // TODO escape file.name
+        '<input type="hidden" name="file:' + id + '" value="' + escapeHtml(file.name) + '"/>'
         '</li>';
       $('#assets-list').append(attach);
       $(file.previewElement).prevAll('div.dz-preview').addBack().remove();
diff --git a/src/main/webapp/assets/common/js/gitbucket.js b/src/main/webapp/assets/common/js/gitbucket.js
index db16822..991b254 100644
--- a/src/main/webapp/assets/common/js/gitbucket.js
+++ b/src/main/webapp/assets/common/js/gitbucket.js
@@ -351,12 +351,12 @@
   }
 }
 
-///**
-// * escape html
-// */
-//function escapeHtml(text){
-//  return text.replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/"/g,'&quot;').replace(/>/g,'&gt;');
-//}
+/**
+* escape html
+*/
+function escapeHtml(text){
+ return text.replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/"/g,'&quot;').replace(/>/g,'&gt;');
+}
 
 /**
  * calculate string ranking for path.