mozilla/browserid — pull request #1569 by shane-tomlinson (2012-05-10 15:35:31+00:00)
Title: Put RP name and logo into the dialog.

@warner, @lloyd, @benadida - Can you guys give this a thorough review?

Important areas to check -
controllers/dialog.js - I added a check to only allow the characters specified in RFC 3986 in a URL.
controllers/rp_info.js - the logo src and site name are both written using javascript instead of in templates. If the dialog is in http mode, logos from http and https are allowed, if the dialog is in https mode, only logos from https are allowed.

I am still using logoURL as the field in navigator.id.request - this is so we can expand the use of this field to include fully qualified URLs as well as data URIs once we better understand the security implications of doing so.

======
commit log

* Add a new controller and template - rp_info
* Adjust the screen size hacks to take into account the dynamic height "favicon"
* Add an action to start the rp_info service.

Secondly, be much more strict about input that comes from external sources.

* Only certain characters are allowed in URLs
* Only absolute paths are allowed for logoURL
* if serving and https dialog, logoURL must be https

issue #1098