Launchpad itself

  1. Bug #394032
  2. Comment #3

Comment 3 for bug 394032

Revision history for this message
Deryck Hodge (deryck) wrote :

I opened a bugtask against lazr-js since this problem affects the picker. And I would imagine we are quite open to XSS where we use the pattern of Y.Node.create(some_list_of_strings.join('')) and that pattern is everywhere.