# HG changeset patch # User Julien Cristau # Date 1391614461 -3600 # Node ID cd5738fc440fb2fc8f2a872a5d43e8dcc78aa537 # Parent 8154a574819443fdb0d8e652ded8f8e514a4cafd [ajax] use a custom tag to handle dynamically loaded js Using

 makes it trivial for a malicious user to
inject arbitrary javascript into a html or rest text element (because it
looks innocent to the html sanitizer).  Using a custom tag we can be
sure that it actually comes from our code and not from untrusted user
data.  IE ignores custom tags, though, so we put it in its own namespace.

https://extranet.logilab.fr/1530578

diff -r 8154a5748194 -r cd5738fc440f utils.py
--- a/utils.py	Mon Feb 03 19:07:58 2014 +0100
+++ b/utils.py	Wed Feb 05 16:34:21 2014 +0100
@@ -375,9 +375,9 @@
             if skiphead:
                 # Don't insert