structured-data/linter — Issue #3: XSS when using textarea
Author: AaronAsAChimp
Created: 2012-03-09 19:28:54+00:00
State: open

Inserting the following markup into the validate by direct input and clicking submit will potentially cause cross site scripting vulnerabilities. If you switch back to the direct input tab you see the heading "Hello World". Replacing it with a script tag will cause untrusted code to be run in some browsers.

Hello World!

This can be fixed simply by escaping the < and >.