Growl should escape message strings by default

[johnnyshields]

Seems like currently this plugin does not escape the message string (though the public demo does), which could lead to injection vulnerabilities. I think it should be escaped by default, with an option to disable the escaping if the user knows what they are doing.

[mouse0270]

I don't think the public demo escapes the message string. jQuery just grabs the html from a content-editable div. Just to make sure we are talking about the same thing, you are refering to something like this: http://www.w3schools.com/jsref/jsref_escape.asp

[johnnyshields]

Yes, correct something like the example you gave.

I think the escaping in the demo is done by jQuery then, but BootstrapGrowl doesn't do escaping by itself.

My concern is that if a server echoes some user input into the growl message (for example "Your input '____' is invalid") it could be used for XSS attack. By default it would be best to err on the side of safety, i.e. escape all inputs.

[strokyl]

+1

[mouse0270]

This is being added to version 4.0beta and later.