defnull/bottle — Issue #267: Possible JavaScript injection in line 837
Author: iurisilvio
Created: 2011-12-16 16:44:58+00:00
State: open

It was reported in Twitter: https://twitter.com/#!/bw0x00/status/147704870848311297
Line 837: https://github.com/defnull/bottle/blob/master/bottle.py#L837

I tried to create some example to exploit this bug, but I didn't know how to do it.

I guess this error page should be rendered with SimpleTemplate, even if it is really simple to construct the page without it. It doesn't affect performance.