Fix Cross Site Scripting vulnerabilities in Openradar.

timburks / openradar

A Google App Engine app for sharing information about radars that we've submitted.

http://openradar.appspot.com

Apache License 2.0

375 stars 39 forks source link

Fix Cross Site Scripting vulnerabilities in Openradar. #14

Closed lionaneesh closed 9 years ago

lionaneesh commented 11 years ago

Autoescaping doesn't happens automatically because Google App Engine as a default imports Django 0.96 templates.

The fix uses Django 1.2 (with autoescaping)

This pull request should be merged immediately because this bug can be used to inject malicious JS or HTML code. The current deployment contains several XSS vulnerabilities both persistent and non-persistent. [http://en.wikipedia.org/wiki/Cross-site_scripting]

timburks commented 9 years ago

I believe this is fixed with the update to Python 2.7. Thanks for your patience!