From 44be2beb67820cfef65e39e07c50d50f02458858 Mon Sep 17 00:00:00 2001
From: Luke Stokes <luke.stokes@gmail.com>
Date: Mon, 13 Nov 2017 13:40:45 -0600
Subject: [PATCH] Fixes an XSS concern with non-get uris like so:

---
 browser.html | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/browser.html b/browser.html
index d06e3f9..912e6e8 100644
--- a/browser.html
+++ b/browser.html
@@ -169,10 +169,10 @@ <h3>Expand URI Template</h3>
       <h3>Make a non-GET request</h3>
     </div>
 
-    <form class="non-safe" action="<%= href %>">
+    <form class="non-safe" action="<%= _.escape(href) %>">
       <div class="modal-body">
         <p>Target URI</p>
-        <input name="url" type="text" class="url" value="<%= href %>" />
+        <input name="url" type="text" class="url" value="<%= _.escape(href) %>" />
         <p>Method:</p>
         <input name="method" type="text" class="method" value="POST" />
         <p>Headers:</p>