search

dazzz1er / confer

Easy real-time chat for laravel 5 based websites and applications
133 stars 47 forks source link

XSS #6

Closed jimilinuxguy closed 9 years ago

jimilinuxguy commented 9 years ago

Downloaded confer yesterday and got it installed after doing the demo. (Thanks for helping by email to set it up)

Presently you can send javascript and images into the channel and it will render them locally and with the other participants in the chat.

dazzz1er commented 9 years ago

Thanks @jimilinuxguy I have escaped all human input (didn't know about blade's {{{ }}}), which should resolve this issue