[SHINDIG-89] Prefs / view parameter escaping

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Component/s: Javascript
• Assignee: Kevin Brown
• Reporter: Kevin Brown
• Due: 22/Feb/08
• Created: 22/Feb/08 02:41
• Updated: 28/Apr/14 11:45
• Resolved: 22/Feb/08 12:28

Description

Currently, we do not escape gadgets.Prefs or gadgets.views parameters.

This could potentially result in exploits of data by malicious outside sites.

To remedy this, I propose the attached patch.

As it stands, the spec is silent on the escaping issue, but in practice gmodules.com already does this escaping for user prefs and I suspect that other container sites do as well.

I've also included an unescaping mechanism that I think should ultimately be proposed to the spec discussion group, but that's a later issue.

Feedback is much appreciated. If no one objects, I'll commit this change tomorrow morning.