zendframework/ZendSkeletonApplication — pull request #224 by weierophinney (2013-11-01 17:08:11+00:00)
Title: Default error page possible XSS

Hello!

The default error page:
module/Application/view/error/index.phtml
is vulnerable to Cross-Site-Scripting issues, if the exception message (and to a limited extend also a string parameter in the call-stack) contains user supplied input.
All outputs of "getMessage()" and "getTraceAsString()" should be guarded by "$this->escapeHtml(...)".
Affected are the lines 17, 21, 41 & 45.

Best regards,

Das