search

dealertrend / wordpress-plugin-inventory-api

This is the new WordPress plugin for DealerTrend, Inc. It will interface with their Automotive Information System's API.
http://www.dealertrend.com
GNU General Public License v2.0
22 stars 6 forks source link

Sanitize inputs from API URL JSON #6

Closed Ryuske closed 13 years ago

Ryuske commented 13 years ago

PoC: If you built the same file structure on a remote host as is on the dealertrend api server, and then in the inventory feeds placed XSS somewhere in one of the fields that are output. And then if you changed the backend URL to your rouge API URL your XSS would be persistent on the inventory listings

Ryuske commented 13 years ago

Blocked: The API has legitimate HTML in it, so until that is changed, there is no way to fix this.

grok commented 13 years ago

The API should not have HTML in it IMO.

But - I guess the question is - are we using any of the fields that have HTML in it?

grok commented 13 years ago

We've resolved this by no longer using the one field that returns HTML.

By doing this - we can now put it towards a deprecation page.