mozilla/r2d2b2g — pull request #529 by mykmelez (2013-05-15 21:05:27+00:00)
Title: escape warning and error messages

Fixes #522.

After looking into this, I think @kmaglione is right that there's a potential vector here, although I haven't identified a specific attack. But we want defense in depth, so we should mitigate against the potential risk, even without a known exploit.

Here's a fix that unconditionally escapes the warning and error messages in the Dashboard template. This has the side-effect of <pre>formatting all messages, since the template can't distinguish between JSON linter messages (which are preformatted) and other messages (which aren't). I think that's ok, since the other messages are short one-liners that still look reasonable. But in the future we might consider annotating each message with a hint about how to format it.

@potch introduced this template post-3.0, so I'll need to craft a different fix for a 3.0 hotfix update if we decide to include this in one.