How do I know if my AJAX request is vulnerable to XSS?

A security firm surprise audited a web app I work on, and told me that there are XSS vulnerabilities. I don't really know where to begin.

This is the AJAX:

new Form.Observer('filter', 0.5, function(element, value) 
{
    startLoad('proposals');; 
    new Ajax.Updater('proposals', 'http://acme.example.dev/stuff/filter', 
        {
            asynchronous:true, evalScripts:tru开发者_如何学Ce, onComplete:function(request)
                {
                }, parameters:value + '&authenticity_token=' + encodeURIComponent('base64StringHere')
        })
});

---

It's hard to say for sure how to track down the vulnerability, since it's not clear what user input your page is displaying. Since you're using RoR, the best place to start is probably the XSS section of the RoR security guide.

You could also try running a scanner like skipfish. It will try to automatically detect XSS and other security vulnerabilities, and if it finds them it will give you some details and documentation to help fix the problem.