XSS (javascript execution vulnerability)

[dobryakov]

Steps to reproduce:

1. Setup this gem for oauth through social network (vk.com in my case).
2. Change your username to <script>alert('Hi!');</script>
3. Logout and try to login through social network.
4. See the "Hi!" alert :)

Reason:

app/views/devise_token_auth/omniauth_external_window.html.erb

Workaround:

# app/models/user.rb
def username
  CGI::escapeHTML( read_attribute(:username) )
end

[dobryakov]

Right solution:

var data = JSON.parse(decodeURIComponent(' <%= URI::escape( @data.to_json ) %> '));

[booleanbetrayal]

thanks for this catch @dobryakov ! Fixed in 9fdf831