r888888888/danbooru — pull request #2296 by evazion (2014-10-29 04:04:43+00:00)
Title: Fix XSS in fetch source data javascript.

The fetch source data javascript doesn't escape the artist name or untranslated tags. Exploitable by tricking someone into clicking on a link to upload a Pixiv post with malicious tags. Test case: http://danbooru.donmai.us/uploads/new?url=http://pixiv.net/i/46785915.