graphite-project/graphite-web — pull request #457 by illicium (2013-10-04 20:26:38+00:00)
Title: browser, composer: escape target/queryString template variables

This fixes:

* XSS

e.g. `?target="/>