search

KoltesDigital / atom-foxdot

FoxDot interface for Atom
10 stars 3 forks source link

Evaluating lines that contain HTML leads to XSS #14

Closed MrMebelMan closed 3 years ago

MrMebelMan commented 3 years ago

Evaluation of this string

'<iframe src="https://player.vimeo.com/video/148751763?title=0&byline=0&portrait=0&transparent=0&autoplay=1" width="640" height="480" frameborder="0" allow="autoplay; fullscreen" allowfullscreen></iframe>'

leads to iframe being injected in the logger window 🕺

Selection_999(083)

I've found this after investigating why I can't see Player objects when executing print(Clock)

Here's the related PR that adds HTML escaping to both input and subprocess output: https://github.com/KoltesDigital/atom-foxdot/pull/13

KoltesDigital commented 3 years ago

Wow I've been ... 😆

Fixed by 451dee9850ed079013fcf18188f4f21226254876. Discussion continues in the PR #13.