[Bug 61743] Security review for 'Popups' Extension

https://bugzilla.wikimedia.org/show_bug.cgi?id=61743 --- Comment #4 from Chris Steipp cste...@wikimedia.org --- (In reply to Prateek Saxena from comment #3) (In reply to Chris Steipp from comment #2) I'm mostly concerned about the $contentbox portion, since that is generated from user

[Bug 61743] Security review for 'Popups' Extension

https://bugzilla.wikimedia.org/show_bug.cgi?id=61743 --- Comment #5 from Chris Steipp cste...@wikimedia.org --- (In reply to Chris Steipp from comment #4) We are using .text() when placing the extract in the Popup[1]. Are there any other measures that need to be taken? The other elements are

[Bug 61743] Security review for 'Popups' Extension

https://bugzilla.wikimedia.org/show_bug.cgi?id=61743 Chris Steipp cste...@wikimedia.org changed: What|Removed |Added Status|NEW |RESOLVED

[Bug 61743] Security review for 'Popups' Extension

https://bugzilla.wikimedia.org/show_bug.cgi?id=61743 --- Comment #2 from Chris Steipp cste...@wikimedia.org --- (In reply to Prateek Saxena from comment #1) Instances of `.html()` - 1. In the `createBox` method I do something like: $el.html( $el.html() ); Its to refresh the DOM and

[Bug 61743] Security review for 'Popups' Extension

https://bugzilla.wikimedia.org/show_bug.cgi?id=61743 Chris Steipp cste...@wikimedia.org changed: What|Removed |Added Assignee|wikibugs-l@lists.wikimedia.

[Bug 61743] Security review for 'Popups' Extension

https://bugzilla.wikimedia.org/show_bug.cgi?id=61743 --- Comment #3 from Prateek Saxena psax...@wikimedia.org --- (In reply to Chris Steipp from comment #2) I'm mostly concerned about the $contentbox portion, since that is generated from user content. We are using .text() when placing the

[Bug 61743] Security review for 'Popups' Extension

https://bugzilla.wikimedia.org/show_bug.cgi?id=61743 Andre Klapper aklap...@wikimedia.org changed: What|Removed |Added Priority|Unprioritized |Normal -- You

[Bug 61743] Security review for 'Popups' Extension

https://bugzilla.wikimedia.org/show_bug.cgi?id=61743 Andre Klapper aklap...@wikimedia.org changed: What|Removed |Added CC|

[Bug 61743] Security review for 'Popups' Extension

https://bugzilla.wikimedia.org/show_bug.cgi?id=61743 --- Comment #1 from Prateek Saxena psax...@wikimedia.org --- Instances of `.html()` - 1. In the `createBox` method I do something like: $el.html( $el.html() ); Its to refresh the DOM and display the SVG elements (see comments in the

[Bug 61743] Security review for 'Popups' Extension

https://bugzilla.wikimedia.org/show_bug.cgi?id=61743 Prateek Saxena psax...@wikimedia.org changed: What|Removed |Added Blocks||61167 -- You