ppi/skeletonapp — Issue #3: Possible but not confirmed security issue with inline JS includes.
Author: dragoonis
Created: 2011-12-20 05:50:56+00:00
State: open

We can do ```$this->addJS('somefile');``` in our controller code addiing multiple files. the result is the following format.

``` html

```

The code parsing this is here: https://github.com/ppi/skeletonapp/blob/master/scripts/js.php

``` php
$modules = isset($_GET['mod']) ? explode(',', str_replace('../', '', $_GET['mod'])) : array();
```

Even though a '.js' is appended onto the end, this doesn't rule out some kind of null-terminated string bug.

Patches++ !