Comment 7 for bug 1822630

We've had a potential fix for this bug for several months; it needs to be reviewed, signed off, and committed (fortunately it's a clean backport). I've targeted the bug for the next round of point releases, so hopefully it will get the attention it needs now.

Note that we have another pending XSS-related security fix (bug 1559239) which has been signed off and just needs to be committed.