The online editor is vulnerable to HTML injection

[huonw]

E.g. running the following (no main or anything):

"<h1>hello</h1>"

has the following output in the error box

error: expected item but found `"

hello

"`

cc @SergioBenitez

[huonw]

Simply printing some HTML (like fn main() { println!("<h1>hello</h1>"); }) is also affected.

(The worst part of this is some type errors have <...> in them, e.g. fn main() { let () = 1; } ... expected <generic integer #0> ..., meaning part of the error message gets eaten.)

[adrientetar]

I think that editor.js#L117 should use .textContent instead of .innerHTML.

http://www.w3schools.com/dom/prop_element_textcontent.asp

[SergioBenitez]

@adrientetar We want to have line breaks in the output. The easiest, and perhaps the cleanest, way to accomplish this is to replace new lines with <br /> and set innerHTML. The alternative is to create multiple span elements for each line, set their textContent, place a <br /> node between them, and then set each of those elements as a child of the result div.

An easier solution to the problem is to simply escape the HTML before it's inserted into the DOM. I'm working on this solution now.

[SergioBenitez]

Pull request #31 addresses this issue.

[alexcrichton]

Looks like this has been fixed, yay!