Jasig/uPortal — pull request #373 by jhelmer-unicon (2014-07-02 06:28:37+00:00)
Title: [up-3315] Fix some XSS issue around inputting usernames.  The issue was ...

...occurring because "" always terminates the

JS block -- even if that's inside a string. The JS interpreter would terminate the block and then misinterpret the unterminated
contents of the string as executable code. The *right* solution for this is probably to start whitelisting the
input characters for every input field. Any field that will be part of a RESTful URL should not be allowed to contain the '/'
character. The "solution" in this commit is intended as a stop-gap. It solves this biggest issue -- the XSS vulnerability --
but it doesn't fully solve the issues caused by invalid chars in the input. IMO, this is better than what we had, but
still not great.