#11 Update the hyperlink/deeplink bouncer code itself

Closed
opened 6 years ago by vaeringjar · 2 comments

I think this might have an XSS vulnerability; need to sanitize the user input.

https://notabug.org/vaeringjar/id.ly/src/debian9-android/src/remote/index.php

I think this might have an XSS vulnerability; need to sanitize the user input. https://notabug.org/vaeringjar/id.ly/src/debian9-android/src/remote/index.php
vaeringjar commented 6 years ago
Owner

PHP's FILTER_SANITIZE_EMAIL should probably take care of the worst.

Anything else can just hard fail.

PHP's `FILTER_SANITIZE_EMAIL` should probably take care of the worst. Anything else can just hard fail.
vaeringjar commented 6 years ago
Owner

Just to explicated; tested successfully blocking:

index.php?m=%3Cscript%3Ealert(%22helloworld%22);%3C/script%3E

Just to explicated; tested successfully blocking: `index.php?m=%3Cscript%3Ealert(%22helloworld%22);%3C/script%3E`
Sign in to join this conversation.
No Milestone
No assignee
1 Participants
Loading...
Cancel
Save
There is no content yet.