search

artesaos / seotools

SEO Tools for Laravel
MIT License
3.12k stars 505 forks source link

XSS Responsibility? #326

Open iBotPeaches opened 3 months ago

iBotPeaches commented 3 months ago

What steps will reproduce the problem?

  1. Insert an XSS into SEOTools::setTitle(); or SEOTools::setDescription();
  2. View Site
<script type="application/ld+json">{"@context":"https://schema.org","@type":"WebPage","name":"<script>alert(0)</script> on Bazaar","description":"<script>alert(0)</script> on Bazaar in Custom at Aug 1, 2024 with: xxx","image":"https://blobs-infiniteugc.svc.halowaypoint.com/ugcstorage/map/298d5036-cd43-47b3-a4bd-31e127566593/5546a6ec-841d-4955-be7a-5f32c3ac0428/images/thumbnail.png"}</script>

What is the expected result?

  1. Nothing happens, but encoded text.

What do you get instead?

  1. An XSS

Additional info

Q A
This Package Version 1.3.1
Laravel Framework Version 11.x

Should the package be cleansing data prior to writing to tags? Or is it up to me to cleanse data prior to injecting into library?