nodester/nodester — Issue #275: Username isn't escaped on account creation
Author: brianewing
Created: 2012-01-18 19:38:52+00:00
State: open

When creating a new user, the username isn't escaped (see [line 174, user.js](https://github.com/nodester/nodester/blob/master/lib/user.js#L147)).

As such, one could send a request to the API with the username eg. "; sudo rm -Rf --no-preserve-root /; echo " and run commands as **root** on the server.