Hello Trolls

It is easily possible to do cross-site-scripting (XSS) with XmlListModel.

As a simple example, you can take the QML Flickr sample application provided with Qt and in the search box enter the single character '#'. The application no longer displays images. In fact, the # character commented out half of the http request sent to flickr.

This problem is due to the fact it is not (yet?) possible to properly escape characters in the query part of the URL given to the "XmlListModel.source" property.

I think, it should be simple to escape elements in the query part of http request (http://en.wikipedia.org/wiki/URI_scheme#Generic_syntax).

Best regards,
Eric