psybuzz/goldenconversations — pull request #17 by psybuzz (2014-08-16 00:18:05+00:00)
Title: Escape HTML entities

This PR addresses the security of saved content. When users, conversations, posts, groups are created or saved, we currently don't escape special characters. With posts, especially, this can cause unwanted behavior. For example, posting:

`Be the change you want to see...` would appear as: 'Be the change you **want** to see...'.

In this case, bolding letters is pretty benign. But what if some user posted:
`Be the change you want to see. ` ?

This would effectively redirect your browser to google.com whenever you loaded the comment. In order to prevent things like arbitrary script tags from being executed, we can replace things like `<` and `>` with their HTML entities.

This PR adds an .escape() utility method which gets called whenever something is created or saved. In addition, the client side code has been updated to use .innerText in addition to jQuery's .append(), as the latter will add the provided string as HTML.