hellais/TorStatus — Issue #5: HTML not sanitized in contact information on router page
Author: mutantmonkey
Created: 2012-02-08 08:39:58+00:00
State: open

Router pages do not sanitize the contact information (and possibly other info) before displaying it, potentially allowing for cross-site scripting vulnerabilities and other problems. An example of this can be seen here (note that the contact email address is not visible):

http://hellais.github.com/TorStatus/#details/3077DF82E3E8958D5F9BB02FA0A2D1ECADE8F411