Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix Tooltip vulnerable to XSS #299

Closed
reglim opened this issue Oct 4, 2022 · 1 comment · Fixed by #300
Closed

Fix Tooltip vulnerable to XSS #299

reglim opened this issue Oct 4, 2022 · 1 comment · Fixed by #300

Comments

@reglim
Copy link
Contributor

reglim commented Oct 4, 2022 •
edited
Loading

You have to omit the last "/" when you create a project, but the engine will fill it in and display something like that:
(i created a project called "< h1 > inject < h1 >")

XSS

The solution would be to just escape the project name for the tooltip.
reglim added a commit that referenced this issue Oct 4, 2022
@reglim
Fix(web): Tooltips vulnerable to XSS
2246f3a 
It seems the library we use doesn't escape the content. Because of this,
I just added it seperately.

fixes: #299
@reglim
Copy link
Contributor Author

reglim commented Oct 4, 2022

Now it looks like this:

XSS-After

@reglim reglim mentioned this issue Oct 4, 2022
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Fix(web): Tooltips vulnerable to XSS docat-org/docat
1 participant
@reglim