Cross-site Scripting "Attack" #50

New Issue

corbz · 2024-08-22T18:03:10Z

corbz commented

2024-08-22 18:03:10 +00:00

The user can submit text which wont be escaped when rendered, although as it stands, it shouldn't affect other users due to how SavedGuilds are created on a per-user basis.

Replicate:

Add new server popup
Inspect on the <select> elem
Edit the text inside the <option> elem to some malicious code

The user can submit text which wont be escaped when rendered, although as it stands, it shouldn't affect other users due to how `SavedGuild`s are created on a per-user basis. <img width="983" alt="image" src="attachments/c6e86cd8-6fbe-449b-99a8-f3166b3b1449"> Replicate: 1. Add new server popup 2. Inspect on the `<select>` elem 3. Edit the text inside the `<option>` elem to some malicious code

image.png

87 KiB

corbz added the

bug

label 2024-08-22 18:03:10 +00:00

corbz self-assigned this 2024-08-22 18:03:10 +00:00

corbz added this to the PYRSS project 2024-08-22 18:03:10 +00:00

corbz commented

2024-08-31 14:06:17 +00:00

Given the current way this app works, this would only affect the own user, and is not therefor a proper xss attack, however the future scope of the project is to make these saved guilds shared objects for many users, meaning this will be an issue in the future if not fixed now.

corbz commented

2024-09-12 19:19:32 +00:00

solved in 0.3.4

corbz closed this issue

2024-09-12 19:19:32 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: corbz/PYRSS-Website#50