Remove all |raw from the template files

duvholt / TDT4237

TDT4237 Software Security Patentsy

0 stars 0 forks source link

Closed ogdans3 closed 8 years ago

ogdans3 commented 8 years ago

Fix XSS issue by removing all piping to the raw filter.

This will resolve #1 and partially resolve #4 and #5.

duvholt commented 8 years ago

Doesn't seem like it's possible to execute XSS since quotes are escaped. At least I wasn't able to break out of the href quotes.