Escaping HTML

Open JeremyRand opened this issue 8 years ago • 1 comments

The code at https://github.com/namecoin/ncdns/blob/09a88dc989df29910e368d9e7385bdaaeb82049f/server/web.go#L93 doesn't seem to be escaping HTML. Or at least, I can't convince myself by looking at the code that it's properly escaping HTML, and the gas static analysis tool can't convince itself of this either.

Nov 08 '17 23:11 JeremyRand

@hlandau any chance you could improve this?

Nov 19 '17 07:11 JeremyRand