instructure/lti1_tool_provider_example

HTML output not escaped

Opened this issue · 2 comments

icc commented

Thank you for a great tool which makes testing LTI simple!

I noticed that the values printed in assessment.erb are not escaped. This will cause issues if you test agains e.g. Moodle which uses JSON for sourcedid. Anyway I think the tool should escape the html output using e.g. Rack::Utils.escape_html(text)

bracken commented

JSON sourcedid? That's cool. Think you could paste an example value that is sent for us to test with?

icc commented

Of course, the HTML looks like this with no escaping:

<input type="hidden" name="launch_params[lis_result_sourcedid]" value="{"data":{"instanceid":"1","userid":"2","launchid":1232306510},"hash":"e26bada8e76f271680d3d014237fc54cfe747d7621589df128c6a5b0c71c6b33"}" />

I guess simply replacing " with &quot; in the value would be enough.

I'm testing agains the latest Moodle 2.7.