commonsense team mailing list archive

[Rob Speer <rspeer@xxxxxxx>]

Yuck. Thanks for finding that.

Concepts are now HTML-escaped when formatted in a linked assertion.

-- 
Statement display mechanism allows execution of arbitrary javascript
https://bugs.launchpad.net/bugs/593232
You received this bug notification because you are a member of
Commonsense Computing, which is a direct subscriber.

Status in Open Mind Commons: New

Bug description:
The interface for submitting/displaying statements to OMCS allows arbitrary markup; any html you type will be rendered directly on the page displaying your statement.  This may be a security issue.