Potential XSS vulnerability

[denvercoder1]

Potential XSS vulnerability

[DenverCoder1]

Using htmlspecialchars() to escape the the lines seems to be a sufficient fix.

I'll just need to double check that there's nothing in SVGs that needs to be treated separately.

Output with running htmlspecialchars on each line:

...
<textPath xlink:href='#path1'>
  Second line of &lt;/textPath&gt;&lt;/text&gt;&lt;script&gt;alert(&quot;xss?&quot;)&lt;/script&gt;&lt;text&gt;&lt;textPath&gt;
</textPath>
...

Example SVG with new code

Changes (currently in xss-fix branch): ff76298

[DenverCoder1]

Thanks for your help @plamoni!

With #8, I think it should be safe now.