search

Horndev / zapread.com

Website for zapread.com
https://www.zapread.com
GNU Affero General Public License v3.0
18 stars 4 forks source link

(Client Side?) Denial of Service rendering ZapRead unusable. #382

Closed Horndev closed 4 years ago

Horndev commented 4 years ago

Credit: fwtf

Impact: Big error on index page, Chat and likely other places.

Steps to reproduce:

  1. Make a comment under a new post. OR send chat msg or post something or whatever
  2. Rename yourself to ../../../../Post/Detail/4998/ (Possibly more ways)
  3. See that index page (https://www.zapread.com/?l=1) is unusable.
  4. Rename yourself to a usual name to undo the DoS

Mitigation: Stricter rules for names You should probably white list ranges of unicode code points.

Horndev commented 4 years ago

Fixed by removal of / and \ from aliases.