Inline editor does not escape input before rendering.

[Jeroen T. Vermeulen]

I can inject HTML into my own view of a page (though not someone else's) by inline-editing a bug title. After saving, the editing widget displays its text directly as HTML. The text that goes to the server is of course safe, since it's HTML-escaped by the view before rendering.

Reporting this as a security risk because it could conceivably be used to trick privileged users into editing and saving a bug title with an injection still in it.

[Jeroen T. Vermeulen (jtv)]

I'm going crazy. My reviewer last night (hi cprov) pointed out that he could not reproduce the problem on RF, though today I find that I can on staging and edge (both r7936).

[Jeroen T. Vermeulen (jtv)]

Turns out to be a matter of how I sliced my branches. We had two injection vectors: one in the pre-existing inline editor, solved by my lazr-js branch; and another in the web service, which leonardr fixed before landing the feature that contained it.

My Launchpad integration branch for the inline editor was what exposed the bug in the web service, back when I first started writing it.