candidate to discuss with @maxtaco

package.json

@@ -1,6 +1,6 @@
 {
   "name": "warpwallet",
-  "version": "1.0.8",
+  "version": "1.0.9",
   "description": "Open Source JavaScript Client-Side Bitcoin Wallet Generator Using scrypt",
   "dependencies": {
     "brew": "*",

release.txt.in

@@ -21,7 +21,13 @@ https://keybase.io/warp/keybase-code-signing-key-2013.asc (ID: 4748 4E50 656D 16
 Version History
 ================
 
-2015-02-01: Status ACTIVE
+2017-05-30: Status ACTIVE
+web/warp_1.0.9_SHA256_c067a5573248a16e56b02f748b0638b94dd0f211284ffa5c58a47b25b344f756.html
+  - Add tags to prevent browsers from spellchecking, autocorrecting, autocapitalizing
+  - Escape user content on email address, in case they're convinced to paste a script into that field
+  - Correct below date on v.1.0.8 which said 2015 instead of 2016
+
+2016-02-01: Status ACTIVE
 web/warp_1.0.8_SHA256_5111a723fe008dbf628237023e6f2de72c7953f8bb4265d5c16fc9fd79384b7a.html
   - Announce new WW Challenge, and close old one.
 

src/coffee/site.coffee

@@ -6,15 +6,15 @@ class Warper
     if window.SALT_DEFAULT?
       $('#salt').val window.SALT_DEFAULT
       $('#salt').attr 'disabled', true
-      $('.salt-label').text 'Prefilled salt'      
+      $('.salt-label').text 'Prefilled salt'
 
   check_compatibility: ->
     if not Int32Array?
       $('.form-container').html '''
         <p>
           Sorry, but your browser is too old to run WarpWallet, which requires Int32Array support.
-        </p>'''  
-        
+        </p>'''
+
   attach_ux: ->
     $('#btn-submit').on 'click',            => @click_submit()
     $('#btn-reset').on 'click',             => @click_reset()
@@ -27,14 +27,16 @@ class Warper
     $('#private-key').on    'click',        -> $(@).select()
     $('.what-salt').on      'click',        => $('.salt-explanation').toggle()
 
+  escape_user_content: (s) -> s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/\"/g, '&quot;').replace(/\'/g, '&#39;')
+
   any_change: ->
     $('.progress-form').hide()
     $('#private-key').val ''
     $('#public-address').val ''
     $('#btn-submit').attr('disabled', false).show().html 'Generate'
     pp   = $('#passphrase').val()
     salt = $('#salt').val()
-    chk  = $('#checkbox-salt-confirm').is ":checked"    
+    chk  = $('#checkbox-salt-confirm').is ":checked"
     err  = null
     warn = null
     if not pp.length
@@ -50,7 +52,7 @@ class Warper
       $('#btn-submit').attr('disabled', true).html err
     else if warn
       $('#btn-submit').attr('disabled', false).html warn
-    else  
+    else
       $('#btn-submit').attr('disabled', false).html "Generate"
     $('.output-form').hide()
     $('#public-address-qr').html ''
@@ -71,10 +73,10 @@ class Warper
     if not salt.length
       $('.salt-confirm').hide()
     if window.SALT_DEFAULT?
-      $('.salt-confirm').hide()      
-    else if @salt_ok() 
+      $('.salt-confirm').hide()
+    else if @salt_ok()
       $('.salt-confirm').show()
-      $('.salt-summary').text salt
+      $('.salt-summary').text @escape_user_content salt
     else
       $('.salt-confirm').hide()
     @any_change()
@@ -119,7 +121,7 @@ class Warper
     $('.progress-pbkdf2, .progress-scrypt').html ''
     $('.progress-form').show()
 
-    warpwallet.run { 
+    warpwallet.run {
       passphrase : $('#passphrase').val()
       salt : $('#salt').val()
       progress_hook : (o) => @progress_hook o
@@ -136,7 +138,7 @@ class Warper
       $('#public-address').val res.public
       $('#private-key').val res.private
       @write_qrs res.public, res.private
-      console.log 
+      return
 
 $ ->
   new Warper()

src/css/site.css

@@ -41,7 +41,7 @@ h1 .second-half {
   color: #666;
   background-color:#ddddd8;
   padding:10px;
-  border-radius: 5px;  
+  border-radius: 5px;
 }
 .salt-explanation p {
   padding:20px;
@@ -147,7 +147,7 @@ h1 .second-half {
 
 .form-horizontal .progress-form {
   margin: 20px 0px 20px 0px;
-} 
+}
 .progress-form {
   background-color: #eee;
 }
@@ -168,11 +168,11 @@ h1 .second-half {
   color:#f90;
 }
 
-hr { 
-    display: block; 
+hr {
+    display: block;
     height: 1px;
-    border: 0; 
+    border: 0;
     border-top: 1px solid #777;
-    margin: 1em 0; 
-    padding: 0; 
-}
+    margin: 1em 0;
+    padding: 0;
+}