Cross-site Scripting (XSS)

formtastic is vulnerable to reflected Cross-Site Scripting XSS. errorsentencehtml uses htmlsafe on unsanitised errors which contain the user input. Hence, after failing validation, the user input is reflected when an error is displayed, causing arbitrary javascript code in the...