pbock/c3t-pad

Generate EtherPad content for the translation angels at 33c3

c3t-pad's Issues

Angle brackets not being escaped/XSS vulnerability

Angle brackets are currently not being escaped in the generated HTML, which means that the title What could possibly go wrong with <insert x86 instruction here>? is parsed as HTML and shows up as What could possibly go wrong with ? in a web browser. This is of course undesirable.

Technically, this counts as an cross-site scripting vulnerability, although the potential for exploitation is very slim because the code only runs locally on one computer and the source of the data is semi-trustworthy.

Talk URL template is hard-coded

The URLs to talk description pages are currently based on a hard-coded template (https://fahrplan.events.ccc.de/congress/2016/Fahrplan/events/${id}.html) which works only for 33c3 but would have to be changed manually for future events.

There's no easy solution to this because the Fahrplan lists neither URLs to the individual talk pages nor a URL template.

The least annyoing solution is probably to create a configuration file that maps congress identifiers to URL templates. This still requires maintenance, but it's a bit more obvious than burying it somewhere deep in the template.