XSS protection for Twitter_Form_Decorator_Errors

[dbistriceanu]

Because error messages usually contain user input, it would be safer to properly sanitize them to prevent possible XSS attacks, as the error messages are outputted directly as HTML in your Twitter_Form_Decorator_Errors:

...
$errorHtml = "";
foreach($errors as $currentError)
{
    $errorHtml .= '<span class="help-block">'.$currentError.'</span>';
}
...

One possible way to do this would be by replacing

$errorHtml .= '<span class="help-block">'.$currentError.'</span>';

with

$errorHtml .= '<span class="help-block">' . htmlentities($currentError) . '</span>';

This will convert all applicable characters from the error messages to their corresponding HTML entities, and as such offer the desired XSS protection.