philwareham/txp-h5bp-theme — Issue #15: XSS and search term
Author: gocom
Created: 2011-12-16 22:11:03+00:00
State: open

While there is no XSS exploit in the sense that you could inject code to the page, the `````` tags on the search_results form can still be used inject offensive content to page. This content can be, for example, used to blacklist targeted website from search engine's index.

To prevent content injection and it's bad results, I would either;

* Remove ``````.
* Add noindex, nofollow robots directive to the search results page.
* And (additionally) make the searched term (``````) only appear in the search form's input.