mozilla/socorro — pull request #2381 by AdrianGaudebert (2014-09-19 06:32:15+00:00)
Title: Fixes bug 1069077 - Removed encoding of HTML characters in signature in JS.

@peterbe Is this the correct solution? The problem here is that a signature can contain characters such as ``&`` or ``<``, and those get encoded when they are displayed with jinja, leading to the signature becoming, from ``fun(a&, b<>)``, something like ``fun(a&, b<>)``. That value cannot be understood by the server, of course, so we need to mark the signature as safe. But it's a user-generated value, so it should not be safe!!! Hence the replacement of the quotes inside that variable to make sure it's impossible to execute any code by finishing the string statement.

Is that safe? Did I forget anything? Is there a much better way of doing this that I am not aware of?