<story><title>Timesheet.js</title><url>http://sbstjn.github.io/timesheet.js/</url><text></text></story><parent_chain><item><author>gildas</author><text>The code is potentially vulnerable to XSS injections[1].&lt;p&gt;[1] &lt;a href=&quot;https://github.com/sbstjn/timesheet.js/blob/master/source/javascripts/timesheet.js#L39-L41&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;sbstjn&amp;#x2F;timesheet.js&amp;#x2F;blob&amp;#x2F;master&amp;#x2F;source&amp;#x2F;ja...&lt;/a&gt;&lt;p&gt;edit: Thanks for the downvotes, lesson learned! Never talk about vulnerabilities of a code which is #1 on HN and people will blindly put in production.&lt;p&gt;edit 2: So here is my new comment: &amp;quot;Awesome library! The fact that users can easily enhance its behaviour by using  &amp;lt;script&amp;gt; tags in labels is a great feature!&amp;quot;</text></item></parent_chain><comment><author>tptacek</author><text>You&amp;#x27;re going to be happier and your comments more persuasive if you just ignore downvotes. Like, completely. Your comment was inevitably going to be bolted to the top of the thread regardless of the randos who downvoted you.&lt;p&gt;I upvoted you because good catch, but winced when I did it because of the downvote whining. :)</text></comment>
<story><title>Timesheet.js</title><url>http://sbstjn.github.io/timesheet.js/</url><text></text></story><parent_chain><item><author>gildas</author><text>The code is potentially vulnerable to XSS injections[1].&lt;p&gt;[1] &lt;a href=&quot;https://github.com/sbstjn/timesheet.js/blob/master/source/javascripts/timesheet.js#L39-L41&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;sbstjn&amp;#x2F;timesheet.js&amp;#x2F;blob&amp;#x2F;master&amp;#x2F;source&amp;#x2F;ja...&lt;/a&gt;&lt;p&gt;edit: Thanks for the downvotes, lesson learned! Never talk about vulnerabilities of a code which is #1 on HN and people will blindly put in production.&lt;p&gt;edit 2: So here is my new comment: &amp;quot;Awesome library! The fact that users can easily enhance its behaviour by using  &amp;lt;script&amp;gt; tags in labels is a great feature!&amp;quot;</text></item></parent_chain><comment><author>rmrfrmrf</author><text>You&amp;#x27;re absolutely right, for what it&amp;#x27;s worth. Direct &amp;lt;script&amp;gt; tag injection didn&amp;#x27;t work when I tested it, but the following sure does!&lt;p&gt;&lt;pre&gt;&lt;code&gt;    new Timesheet(&amp;#x27;timesheet-default&amp;#x27;, 2002, 2013, [
        [&amp;#x27;09&amp;#x2F;2008&amp;#x27;, &amp;#x27;06&amp;#x2F;2010&amp;#x27;, 
         &amp;#x27;&amp;lt;img src=&amp;quot;666&amp;quot; onerror=&amp;quot;alert(\&amp;#x27;injection!!\&amp;#x27;)&amp;quot;&amp;gt;&amp;#x27;,
         &amp;#x27;ipsum&amp;#x27;]
    ]);
&lt;/code&gt;&lt;/pre&gt;
Putting HTML elements in the label property itself certainly looks like it&amp;#x27;s unintended design-wise, and IMO escaping input should definitely be the responsibility of this library (or, as gildas suggested, it should at the very least be documented).</text></comment>