jesusabdullah/node-ecstatic — Issue #11: xss issues
Author: substack
Created: 2011-11-24 08:04:46+00:00
State: open

The new directory listing code from nodejitsu's static server has some xss flaws since `req.url` comes directly from the user and hasn't been filtered at all. It should go through a combination of `encodeURI()` and `ent.encode()` before being rendered to the page.