4 ms·
You're absolutely right, for what it's worth. Direct <script> tag injection didn't work when I tested it, but the following sure does! new Timesheet('times
by rmrfrmrf 12y ago
You're absolutely right, for what it's worth. Direct <script> tag injection didn't work when I tested it, but the following sure does!
new Timesheet('timesheet-default', 2002, 2013, [
['09/2008', '06/2010',
'<img src="666" onerror="alert(\'injection!!\')">',
'ipsum']
]);
Putting HTML elements in the label property itself certainly looks like it's unintended design-wise, and IMO escaping input should definitely be the responsibility of this library (or, as gildas suggested, it should at the very least be documented).