mcholste/elsa — pull request #3 by adepasquale (2014-12-17 17:52:48+00:00)
Title: XSS in elsa web

As described and agreed by email, @teoseller has found some XSS vulnerabilities in ELSA web gui. This PR is my attempt to fix some of the vulnerabilities. If there is something you don't like, please advise and I'll try to change it.

I have moved the `escapeHTML` function **inside** the `highlightText` function, in order to cover some injection points previously unescaped. Then I've removed all references to `escapeHTML` in order to avoid double escaping. This fixes the XSS regarding the the "field values".

I also added the `escapeHTML` function in the JS code rendering tab labels, fixing another XSS.

There is one known unpatched XSS in the query history, which I will check as soon as possible, and maybe some more XSS not known yet.