cloudinary/cloudinary_js — pull request #40 by cstigler (2014-12-10 22:39:43+00:00)
Title: Fix XSS vulnerability on cloudinary_cors.html

We use Cloudinary and recently had an XSS vulnerability in it pointed out to us by a security researcher. The cloudinary_cors.html file runs unvalidated input based on a URL parameter, and must be hosted on our domain. Which means a malicious actor could send a user to the specially crafted URL and steal cookies etc from our website.

To fix this, it should set its content via textContent instead of HTML. This PR should fix that (and hopefully not disrupt its legitimate usage).