Merge pull request #45 from jelmerk/xss_bug

Fix for #43
mikekelly · Sep 9, 2014 · 1593f6d · 1593f6d
2 parents 2e831af + 69789f0
commit 1593f6d
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/browser.html b/browser.html
@@ -123,7 +123,7 @@ <h2>Custom Request Headers</h2>
     <h2>Response Headers</h2>
     <pre><%= status.code %> <%= status.text %>
 
-<%= headers %></pre>
+<%= _.escape(headers) %></pre>
   </script>
 
   <script id="response-body-template" type="text/template">