Default embed needs to escape output #9

Open

Labels

opened

on Mar 14, 2014

Right now the widget is rendered as is if no routes match, allowing unsanitized html to be injected. Looks like the sanitizer is catching these but we'll want to encode the content before rendering as an extra precaution.

to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Assignees

No one assigned

Labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests