cadejscroggins/omgcatz — pull request #1 by infosec-au (2014-04-04 06:17:26+00:00)
Title: Usage of .text() instead of .html() to prevent XSS

In jQuery the use of .html() to set values or contents, may lead to DOM based XSS.

For example, on http://catz.thirdletter.com/, if the URL entered is "> and the .html() function from jQuery is used to put the contents of the URL field somewhere, the contents inserted will be unsanitised and hence will lead to XSS. In this case, the XSS is quite harmless as it is self inflicted, however, it is worth noting that using the .html() jQuery function is insecure.

For further reading and information please see:

http://code.google.com/p/domxsswiki/wiki/jQuery

P.S. Love the work put into this project :)