{"version":"2.1.232","anchor":"marketplace-names-are-escaped-in-error-messages","canonical_anchor":"marketplace-names-are-escaped-in-error-messages","heading":"Marketplace names are escaped in error messages","tier":"notice","area":"Plugins","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.232\/e\/marketplace-names-are-escaped-in-error-messages","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.232","markdown":"### Marketplace names are escaped in error messages\n\nMarketplace names are escaped in errors so a hostile name can't inject text.\n\n**What**\n\nWhen a marketplace fails to load or is not found, its name is escaped before being placed into the message, so a hostile name cannot inject text into what you see.\n\n**Details**\n\n- Covers both the `Warning: Failed to load marketplace '` warning and the `Marketplace \"` not-found error from `\/plugin`.\n- Plugin install also passes a callback for the marketplace refresh outcome, so the result of a refresh can be reported back to the caller.\n\n**Evidence**\n\n`Warning: Failed to load marketplace '`, `Marketplace \"`\n\n- Area: Plugins\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 1\/5"}