PLEASE FIX: Security vulnerability - code injection #464
Description
There are security vulnerabilities, making the code susceptible to code injection and/or XSS, and it begins at: data = xml ? xhr.responseXML : xhr.responseText.
The data stored in variable 'data' is eventually passed to a function that either calls "replaceWith" or "html." Given that the response is something like: <script src="badScript.js"></script>, invoking "html" will execute the script in the browser. If invoking "html" then the response should be HTML encoded or data should be sanitized.
Thanks,
Vy