You'll notice
Useful2 Signal2
Plugin install and marketplace screens now normalise third-party text before printing it.
What's wrong with this entry?
Anonymous. No account, no email.
What
The marketplace-add and plugin-install screens now pass marketplace name, plugin version, description, author name and error strings through helpers before display rather than printing them directly, so text that a third-party plugin controls cannot be rendered raw.
Details
- Applied uniformly at every display site in both screens.
- What the helpers strip beyond normalising the text is not visible from the shipped code.
Evidence
Adding marketplace to configuration\u2026
Strings lifted out of the shipped bundle, so the claim above can be checked against them.