I reviewed XSS

gulliver/system/class.soapNtlm.php

@@ -184,6 +184,9 @@ class soapNtlm
      */
     private function createBuffer ($path)
     {
+        G::LoadSystem('inputfilter');
+        $filter = new InputFilter();
+        $path = $filter->xssFilterHard($path, "url");
         if ($this->buffer) {
             return;
         }
@@ -198,6 +201,7 @@ class soapNtlm
         //Apply proxy settings
         if (class_exists( 'System' )) {
             $sysConf = System::getSystemConfiguration();
+            $sysConf = $filter->xssFilterHard($sysConf);
             if ($sysConf['proxy_host'] != '') {
                 curl_setopt( $this->ch, CURLOPT_PROXY, $sysConf['proxy_host'] . ($sysConf['proxy_port'] != '' ? ':' . $sysConf['proxy_port'] : '') );
                 if ($sysConf['proxy_port'] != '') {

workflow/engine/classes/class.Upgrade.php

@@ -33,6 +33,8 @@ class Upgrade
 
     public function install()
     {
+        G::LoadSystem('inputfilter');
+        $filter = new InputFilter();
         //echo "Starting core installation...\n";
         $start = microtime(1);
         $filename = $this->addon->getDownloadFilename();