Reported as security issue a while back, but as this is still in RC and the maintainer has not responded, I have added this a public issue:

Tested with 1.0-rc4 there is an non-persistent XSS vulnerability, URL:
http://example.org/twitter_pull_lazy/WFNT-PHNjcmlwdD5hbGVydCgnWFNTJyk7PC...

Will output an alert with XSS to the user.

Is this functionality used?
If so using check_plain on the title should fix the issue.

CommentFileSizeAuthor
#1 twitter_pull-escape_title_for_html-1971784.patch731 bytesrelaxnow
Support from Acquia helps fund testing for Drupal Acquia logo

Comments

relaxnow’s picture

relaxnow CreditAttribution: relaxnow commented
FileSize
twitter_pull-escape_title_for_html-1971784.patch731 bytes
jec006’s picture

jec006 CreditAttribution: jec006 commented
Status: Active » Fixed

Apparently my spam filter felt the security alert was spam and I didn't see it. In the 7.x branches I've elected to use filter_xss instead of check plain as people may wish to have some markup in their titles (i.e. strong, em etc).

This has been fixed in all branches.

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.