#11 Update the hyperlink/deeplink bouncer code itself

Chiuso

aperto 6 anni fa da vaeringjar · 2 commenti

I think this might have an XSS vulnerability; need to sanitize the user input.

https://notabug.org/vaeringjar/id.ly/src/debian9-android/src/remote/index.php

PHP's FILTER_SANITIZE_EMAIL should probably take care of the worst.

Anything else can just hard fail.

vaeringjar referenced this issue from a commit 6 anni fa

This should take care of some of the problem of xss for now. #11

Just to explicated; tested successfully blocking:

index.php?m=%3Cscript%3Ealert(%22helloworld%22);%3C/script%3E

vaeringjar referenced this issue from a commit 6 anni fa

Finished the fix for the xss attack on the bouncer. #11

vaeringjar chiuso 6 anni fa

Sign in to join this conversation.

bug

help wanted

Nessuna milestone

Nessun assegnatario

1 Partecipanti