From f4992fa40e44b0ed6daba7e8b2f12b23b0691d69 Mon Sep 17 00:00:00 2001 From: Chad Weider Date: Mon, 28 May 2012 12:20:45 -0700 Subject: [PATCH] Data written to document must be escaped. --- src/static/js/pad_utils.js | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/src/static/js/pad_utils.js b/src/static/js/pad_utils.js index c6aeef77f..6e00dc09c 100644 --- a/src/static/js/pad_utils.js +++ b/src/static/js/pad_utils.js @@ -506,8 +506,9 @@ function globalExceptionHandler(msg, url, linenumber) { //show javascript errors to the user $("#editorloadingbox").css("padding", "10px"); $("#editorloadingbox").css("padding-top", "45px"); - $("#editorloadingbox").html("
An error occured
The error was reported with the following id: '" + errorId + "'

Please send this error message to us:
'" - + "ErrorId: " + errorId + "
UserAgent: " + navigator.userAgent + "
" + msg + " in " + url + " at line " + linenumber + "'
"); + // TODO: Use Mustache + $("#editorloadingbox").html("
An error occured
The error was reported with the following id: '" + Security.escapeHTML(errorId) + "'

Please send this error message to us:
'" + + "ErrorId: " + Security.escapeHTML(errorId) + "
UserAgent: " + Security.escapeHTML(navigator.userAgent) + "
" + Security.escapeHTML(msg) + " in " + Security.escapeHTML(url) + " at line " + Security.escapeHTML(linenumber) + "'
"); } //send javascript errors to the server