gittip/www.gittip.com — pull request #724 by wilkie (2013-03-12 07:39:54+00:00)
Title: Bugfix/prevent html injects in statements

Prompted by #722 and then noticing the revert necessary for #723, I simply audited the instances of displaying the statement on the site and found two minor vulnerabilities. They are not server vulnerabilities. That is, they do not directly reveal any personal information or game the site in any way. However, they can override the style, act maliciously, and even inject javascript to fool the user.

**index.html**: meta og:description: **was not escaped**

I confirmed in a development environment that I can indeed close the tag and inject a `` or `` etc in `

`, which is obvi-bad) For instance, a test string would be

```
"/>