SheepDogInc/sheepdog_tables — pull request #9 by bremac (2013-08-22 12:39:09+00:00)
Title: Don't interpolate unescaped strings with the call tag.

Django custom template tags do are not escaped by default. This leads to an XSS attack because all data presented in sheepdog_tables goes through a call tag, which returns results verbatim. To solve this, we need to conditionally escape values in the table -- using conditional escaping instead of unconditional escaping allows columns to implement custom display methods with pre-escaped HTML. This is necessary for ex. FLVQ (which can have links to arbitrary files.)