Several XSS vulnerabities

I can see several instances where scald.module is outputting content from the user or database without any sanitization. I can even do this on the demo site as well.

For example, a few I could find easily in scald.admin.inc:

function scald_admin_dashboard() {
  ...
  foreach ($types as $type) {
    $table['rows'][] = array(
      $type->title, // This is unsanitized and should be output using check_plain()
  ...

function scald_admin_transcoders() {
  ...
  $transcoders_results = db_query("
    SELECT
      *
    FROM
      {scald_transcoders}
  ");
  while ($transcoder_raw = db_fetch_array($transcoders_results)) {
    $content .= '
      <li>
        <strong>' . $transcoder_raw['title'] . '</strong> // Needs check_plain()
        <ul>
          <li><em>' . $transcoder_raw['description'] . '</em></li> // Needs check_plain()
          <li>Provided by &#039; . $transcoder_raw[&#039;provider&#039;] . &#039;.module</li> // Needs check_plain()
        </ul>
      </li>
    ';
  }
  $content .= '</ol>';

  return $content;
}

function scald_admin_actions() {
  ...
  $actions_results = db_query("
    SELECT
      provider,
      title,
      description
    FROM
      {scald_actions}
  ");
  while ($action_raw = db_fetch_array($actions_results)) {
    $content .= '
      <li>
        <strong>' . $action_raw['title'] . '</strong> // Needs check_plain()
        <ul>
          <li><em>' . $action_raw['description'] . '</em></li> // Needs check_plain()
          <li>Provided by &#039; . $action_raw[&#039;provider&#039;] . &#039;.module</li> // Needs check_plain()
        </ul>
      </li>
    ';
  }
  $content .= '</ol>';
  ...
}

I would highly suggest that any developers working on this module take the time to read and understand http://drupal.org/writing-secure-code, specifically http://drupal.org/node/28984. I would then highly recommend a thorough review of all module code by adding things like <script>alert('XSS!')</script> into anywhere a user can provide text input in the module or its sub-modules, and then testing anywhere those values could be output.

Because this module does not yet have a 1.0 official release, this issue is ok to be handled publicly. That said, this module should not have an official 1.0 release until this issue is fixed, otherwise this will have to be handled by the Drupal security team and have an official security release. So it's in your (and the security team's) best interest to fix this before a 1.0 release.