Hacker News Reader

Sorry to bring it up here, but can you check your email for an email from david@daviddworken.com? I previously sent in an XSS vulnerability that you fixed quickly, but I found a second one that has not been patched yet (despite being reported on March 26th).

View on HN

Thanks for reposting that comment here (I posted it on /r/python). I'm now in contact with him and I'll update this once it has been fixed.

It has now been fixed. The problem stemmed from allowing the `Javascript:` scheme for the home_page, download_url, and the url parameters in the setup.py.

Reply on news.ycombinator.com