Materials-Consortia / providers-dashboard

A dashboard of known providers
http://www.optimade.org/providers-dashboard
1 stars 3 forks source link

singlepage.html: validation messages need to be HTML-escaped #164

Open vaitkus opened 3 months ago

vaitkus commented 3 months ago

Validation messages output in the webpages of individual developers are currently not properly escaped, most likely to accommodate replacement of \n with <br />:

https://github.com/Materials-Consortia/providers-dashboard/blob/01223ff81854aa595c55e74edc9e45444b4bb340/make_ghpages/mod/templates/singlepage.html#L109-L113

As a result, symbols like "<" are not escaped (for example in the ResponseError: Request to 'structures?filter=nperiodic_dimensions < 3' returned HTTP status code 500. message).