search

collectiveaccess / pawtucket2

Pawtucket Improved
GNU General Public License v3.0
85 stars 76 forks source link

sanitize input in Tags & Comments #43

Closed gautiermichelin closed 2 years ago

gautiermichelin commented 2 years ago

Strip tags to sanitize input in User profile and in Tags & Comments. I had a mail from Etat.ge.ch audit firm that reports this as XSS injection risk in their automated tool.

collectiveaccess commented 2 years ago

Striptags() is not enough. HTMLPurifier must be used. I'll add that shortly.

collectiveaccess commented 2 years ago

Will merge as HTML tags aren't needed in these inputs.