search

Arachnid / aeoid

Easy OpenID support for App Engine
47 stars 3 forks source link

a javascript target is permitted in the logout view no url #13

Open d1b opened 13 years ago

d1b commented 13 years ago 
In the logout view the 'continue' parameter is placed directly into the href value of the 'no' option without rejecting invalid url/locations (url which are not actual http link). So a javascript target is permitted ... for example   http://SITE.lol/_openid/logout?continue=javascript:alert(1)
results in the following html for the 'No' option : '<a href="javascript:alert(1)">No</a>'.