jjenzz/jquery.ellipsis — pull request #4 by robberwick (2014-11-21 21:15:42+00:00)
Title: Add HTML escaping to remove XSS vulnerabilities

When I cam to use this plugin, I noticed that non-HTML text was being injected back into the DOM as HTML without being escaped first. This leads to XSS vulnerabilities, and means that it is possible for a user to inject malcious javascript code into a page which uses this plugin.

To see this in action, I have created a jsbin with a piece of embedded javascript in the text of one of the divs that the ellipsis plugin is applied to (the responsive one, which is fired on every resize event), which will result in an alert box appearing:
http://jsbin.com/huhiceqege/5/edit?html,css,js,output

and here is the same bin with the patched script:
http://jsbin.com/huhiceqege/1/edit?html,css,js,output