search

Andreone / dokuwiki_plantuml

A plugin for Dokuwiki that generates UML graphs from text using PlantUML
http://www.dokuwiki.org/plugin:plantuml
13 stars 20 forks source link

XSS vulnerabilities #8

Closed michitux closed 13 years ago

michitux commented 13 years ago

As you aren't escaping the title, the width and the height attributes and match for any character arbitrary HTML and JavaScript can be inserted which is directly printed without being escaped. This makes your plugin vulnerable to XSS. (Try something like title Test"><span title="test )

Andreone commented 13 years ago

I'll work on it. Thanks for the report.

Andreone commented 13 years ago

I committed a fix.