travis-ci/travis-ci — Issue #405: Commit messages are not escaped.
Author: vierbergenlars
Created: 2012-02-03 14:16:40+00:00
State: open

Commit messages that use special HTML characters, like < and > are not properly displayed.
This way plain HTML can be injected in the page when viewing a build.
For example: http://travis-ci.org/#!/vierbergenlars/RemoteCP-FS/builds/620603.
The full commit message was

Update modules

Signed-off-by: Lars Vierbergen

It is displayed without the email address between < >, but this information is visible when you view source.
Just imagine someone put a ```