Re:Show HN: I created a Github profile widget (learning to c...
by mbrock on Tuesday July 26, 2016 @04:14AM
(#12164075)
Cool!
If you're not 100% sure that the GitHub data fields (bio, name, etc) are stripped of markup, please ensure that your widget isn't vulnerable to cross-site scripting (XSS).
There are GitHub users whose bios, names, etc contain HTML fragments. The way that your code inserts those fields is likely to be vulnerable. It's better to explicitly treat the fields as text, e.g. by using jQuery's text() method.
If you're not 100% sure that the GitHub data fields (bio, name, etc) are stripped of markup, please ensure that your widget isn't vulnerable to cross-site scripting (XSS).
There are GitHub users whose bios, names, etc contain HTML fragments. The way that your code inserts those fields is likely to be vulnerable. It's better to explicitly treat the fields as text, e.g. by using jQuery's text() method.