dashboard: fix xss in notifications

Closes #374

circle/dashboard/models.py

@@ -31,6 +31,7 @@ from django.db.models import (
 )
 )
 from django.db.models.signals import post_save, pre_delete, post_delete
 from django.db.models.signals import post_save, pre_delete, post_delete
 from django.templatetags.static import static
 from django.templatetags.static import static
+from django.utils.html import escape
 from django.utils.translation import ugettext_lazy as _
 from django.utils.translation import ugettext_lazy as _
 from django_sshkey.models import UserKey
 from django_sshkey.models import UserKey
 from django.core.exceptions import ObjectDoesNotExist
 from django.core.exceptions import ObjectDoesNotExist
@@ -87,7 +88,8 @@ class Notification(TimeStampedModel):
 
 
     @property
     @property
     def subject(self):
     def subject(self):
-        return HumanReadableObject.from_dict(self.subject_data)
+        return HumanReadableObject.from_dict(
+            self.escape_dict(self.subject_data))
 
 
     @subject.setter
     @subject.setter
     def subject(self, value):
     def subject(self, value):
@@ -95,7 +97,14 @@ class Notification(TimeStampedModel):
 
 
     @property
     @property
     def message(self):
     def message(self):
-        return HumanReadableObject.from_dict(self.message_data)
+        return HumanReadableObject.from_dict(
+            self.escape_dict(self.message_data))
+
+    def escape_dict(self, data):
+        for k, v in data['params'].items():
+            if isinstance(v, basestring):
+                data['params'][k] = escape(v)
+        return data
 
 
     @message.setter
     @message.setter
     def message(self, value):
     def message(self, value):