JacksonRiver/springboard_modules — pull request #630 by afreemannc (2014-10-21 19:02:48+00:00)
Title: fix candidate for reflected XSS vulnerability on webform confirmation pages.

A fix in two parts:

When a confirmation message is rendered, the entire confirmation message body is passed through filter_xss_admin() once all webform and token module tokens are replaced.

On the submission side, hook_webform_submission_presave() is implemented to filter webform submission values for XSS vectors before the submission is saved to the database.