potential XSS in chat log

cjb / serverless-webrtc

A demo of using WebRTC with no signaling server.

Other

1.54k stars 239 forks source link

Closed diracdeltas closed 3 years ago

diracdeltas commented 3 years ago

i wasn't able to test this because the demo is broken, but https://github.com/cjb/serverless-webrtc/blob/master/js/serverless-webrtc.js#L314 injects messages as HTML without escaping. so if alice sends <script>alert('hi')</script> to bob in the chat log, it may get executed in bob's browser (https://github.com/cjb/serverless-webrtc/blob/master/js/serverless-webrtc.js#L146)

cjb commented 3 years ago

@diracdeltas I can confirm the XSS worked :) Thanks for the report, fixed now!