When accessing, for instance, a revision in the web API, the JSON data is not escaped.
Example : author -> fullname in https://archive.softwareheritage.org/api/1/revision/18d8be353ed3480476f032475e7c233eff7371d5/
This makes us vulnerable to code injections and should be fixed throughout the API views.
| rDWAPPS Web applications | |||
| rDWAPPSd5ce45a54e0a renderers: escape contents of API return values | |||
For the record, the problem with the specific example is that the actual JSON (which is partly hidden if you look at it via browser), reads:
"author": {
"email": "robot@softwareheritage.org",
"fullname": "Software Heritage <robot@softwareheritage.org>",
"id": 3661419,
"name": "Software Heritage"
},