Srirangan/notifer.js — Issue #1: Vulnerable To Cross Site Scripting (XSS)
Author: vizjerai
Created: 2011-11-03 19:51:24+00:00
State: open

Running this will show an alert for the title and message and not correctly escape the text.

```JavaScript
Notifier.info('', '');
```

The icon could do the same if the string was crafted well enough.

Because of the requirement for jQuery you can use it to create the objects and let it escape the text for you with the .text() method. As well as .attr()

```JavaScript
$('

').text('');
```