vmware-archive / scripted

The Scripted code editor
Eclipse Public License 1.0
1.56k stars 166 forks source link

Location bar is not escaping the file name. #267

Open ikarienator opened 11 years ago

ikarienator commented 11 years ago

It will cause problem if there are special chars in the file name.

For example rename the file to <div onclick="alert('pwnd');">nice.js and you can have a clickable file name on the location bar. Similar tricks can cause automatic code execution.