I'm going to be changing this b/c I'll be extracting the image more
specifically using classes or ids.  Right now the onebox for wikipedia just
grabs the src from the second img in the page.

Vyki Englert
850.819.8808
@toastergrrl


On Thu, Aug 8, 2013 at 1:57 PM, Mark IJbema <notifications@github.com>wrote:

> In templates/wikipedia.handlebars:
>
> > @@ -0,0 +1,8 @@
> > +<div class="onebox">
> > +  <a href="{{url}}">
> > +    <h1>{{name}}</h1>
> > +    <h2 class="host">wikipedia.org</h2>
> > +    <img src="http:{{image}}" />
>
> This is a potential XSS. I noticed this a lot in the old oneboxes as well.
> I think switching to handlebars is smart, since it will prevent most XSS.
> But if you put values inside tags, you don't need < and > to XSS. I agree
> that in the case of wikipedia it might be a tad bit farfetched that I can
> inject in the image url, but on other sites this is quite feasible. Please
> consider adding an encode_quotes helper, or in cases like this where
> they're not needed, just strip them.
>
> —
> Reply to this email directly or view it on GitHub<https://github.com/dysania/onebox/pull/33/files#r5669822>
> .
>