stuttter / wp-spider-cache

Your friendly neighborhood caching solution for WordPress
GNU General Public License v2.0
134 stars 16 forks source link

Missing Escaping #2

Closed tomjn closed 8 years ago

tomjn commented 8 years ago

These locations are missing escaping:

Some places with questionable security:

Some places could do with outputting rather than returning markup so that they can be escaped at output rather than early escaped, do_row is a prime offender:

https://github.com/stuttter/wp-spider-cache/blob/master/wp-spider-cache.php#L863

Otherwise the code looks good, sprintf used correctly for translations, and translations escaped effectively, very nice