csesoc/forte — pull request #1 by infosec-au (2014-03-06 10:40:06+00:00)
Title: Added Jinja2 Autoescape to playlists_view.html

Found that it was possible to inject arbitrary javascript in the onClick attribute. To prevent this, I have used the autoescape functionality of Jinja2, which **should** fix the issue. I have not yet tested if it does though.

In case you were wondering, JavaScript could be added to song.name and the song.artist.