XSS vulnerability (new in v1.2.0)

[philfreo]

Version 1.2.0 introduces a major XSS vulnerability

Version 1.1.0: no problem - http://jsfiddle.net/hxao6bc5/
Version 1.2.0: problem - http://jsfiddle.net/ptsL5md0/

Not sure of which commit introduces it, but here's the diff

[tjschuck]

/cc @pfiller

[obecker]

I have just encountered the same problem.
A solution to the problem is to replace in SelectParser.prototype.add_option (line 61 of chosen.jquery.js) the line

text: option.text,

with

text: this.escapeExpression(option.text),

[ograycode]

This is still an issue in v1.3.0, http://jsfiddle.net/wkm51zzm/

[tjschuck]

Looks like this came in with #1638, which was held up for a while pending XSS issues discussed in #1150.

The conclusions of that may have been insufficient. @stof was seemingly the sign-off on both of those, so maybe he has more to say here. /cc @pfiller

[Intrepidd]

This is a pretty important security issue, is someone working actively on this ?