XWiki-8594 : XSS in Main.SpaceIndex on space name

[tdelafosse]

No description provided.

[mflorea]

Perfect. Now, I'm wondering if we should handle the case when row["${jscolname}"] is null. I know it's an edge case, but considering that Prototype's Element#update() is null-safe it means that some JSON response that worked before (if it worked? even if it's a bad/incomplete response) will break the live table now. Something like:

(row["${jscolname}"] || '').escapeHTML()

could preserve the null-safe behaviour.

[tdelafosse]

Yes I didn't think about that one. Thanks for having seen that :). Fixed.

[mflorea]

Thanks!