mozilla/gcli — pull request #62 by ggayed (2012-10-25 19:23:09+00:00)
Title: change to treat 'string' return types as plaintext

A command whose return type is 'string' can answer a string containing any HTML markup and GCLI will render it as an actual HTML element. This is a security hole for Orion which allows clients to register arbitrary commands. The attached patch ensures that 'string' return types are always treated as plaintext.