OpenSourcePolitics / decidim-app

Open Source Politics' Decidim reference implementation
GNU Affero General Public License v3.0
9 stars 12 forks source link

Fix reflected XSS on meetings versions #584

Closed BarbaraOliveira13 closed 4 weeks ago

BarbaraOliveira13 commented 1 month ago

:tophat: Description

On the meeting versioning show page, a reflected XSS injection vulnerability is present.

https://github.com/user-attachments/assets/5c0d3276-434e-4538-8dfb-9f31d57fd346

:pushpin: Related Issues

Testing

  1. Log in as admin
  2. Select an Assembly
  3. Create a new meeting (make sure the option "users can create meetings" is enabled in the dashboard if needed) and edit it once.
  4. Go to the public page of the meeting.
  5. Select the second version of the meeting (e.g., https://localhost:3000/assemblies/exhibition-general/f/24/meetings/65/versions/2).
  6. In the URL, add at the end: 'XSS%3Cmarquee%20onstart=alert(1)%3Ex or '%3Cmarquee%20onstart=alert(1)%3Ex.
  7. You should not see any JavaScript animation (like in the video above) next to the version number. 🎉
Capture d’écran 2024-09-04 à 15 22 09

Tasks

:camera: Screenshots

Please add screenshots of the changes you're proposing if related to the UI