EmailableReporter does not escape test method parameters.

[GoogleCodeExporter]

I have several TestNG tests that use HTML or Javascript fragments in an 
@DataProvider to test for XSS issues in our web application.

These parameters revealed an XSS issue in EmailableReporter! In other words, I 
see Javascript alerts when I view emailable-report.html.

Looking at:
http://testng.googlecode.com/svn/tags/5.12/src/org/testng/reporters/EmailableRep
orter.java

The problem is:

            for (Object p : parameters) {
              m_out
                  .println("<td style=\"padding-left:.5em;padding-right:2em\">"
                      + (p != null ? p.toString() : "null") + "</td>");
            }

In the snippet above, p.toString() should be HTML-escaped.

Original issue reported on code.google.com by [email protected] on 14 Jul 2010 at 11:00