Dumb XSS hole

[simonw]

select 'select ''<script>alert(/ohno/)</script>'''

https://latest-with-plugins.datasette.io/fixtures?sql=select+%27select+%27%27%3Cscript%3Ealert%28%2Fohno%2F%29%3C%2Fscript%3E%27%27%27

Due to this code:

datasette-query-links/datasette_query_links/__init__.py

Line 36 in 060d385

return markupsafe.Markup('<a href="{}">{}</a>'.format(path, value))

[simonw]

Fix is now deployed: https://latest-with-plugins.datasette.io/fixtures?sql=select+%27select+%27%27%3Cscript%3Ealert%28%2Fohno%2F%29%3C%2Fscript%3E%27%27%27

[simonw]

I'm going to delete the 0.1 release from PyPI just to make absolutely sure no-one ever installs it by accident.

[simonw]

I chose to "delete" rather than "yank" because I'm confident no-one has pinned to version 0.1 of this library anywhere. https://blog.piwheels.org/new-features-deletion-yanking-and-more/