XSS - ListView

[alan-null]

Expected Behavior

No XSS

Actual Behavior

XSS

Steps to Reproduce the Problem

$item = gi -path '/sitecore/content/Home'
$item.Title = '<script>alert(1)</script>'
$item | Show-ListView -Title "Test" -Property @{ Label = 'label'; Expression = { $_.Title } }

[michaellwest]

@alan-null Should it be replaced with anything?

[alan-null]

@michaellwest I think it's a good idea to indicate that someone is trying to do nasty things - I don't have any message/content preferences.