The node type labels in admin interface don't santize. A node type with label <script>alert('XSS');</script> result a JS popup.
Change 34 line in google_plusone.admin.inc 

 '#options' => node_get_types('names'),

to 

'#options' => array_map('check_plain', node_get_types('names')),

Comments

corbacho’s picture

corbacho commented

Thanks Plazik

I was searching in d.o, and saw that Flag module had this bug also in the past and was considered bug, not security issue #483218: role names are not properly sanitized by flag module, since accessing to this page requires administration permission.

Anyway, I will fix it soon, probably tomorrow.

corbacho’s picture

corbacho commented
Status: Active » Fixed

Marking now as fixed.
It has been for several months in the 7.x branch but finally I push the change also to 6.x branch (dev), Sorry for the delay

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.