search

ethz-let / moodle-qtype_drawing

1 stars 6 forks source link

XSS risk from embedding SVG #7

Closed daniil-berg closed 2 years ago

daniil-berg commented 3 years ago

As far as I can see from the formulation_and_controls function in renderer.php as well as from just inspecting the extended drawing capabilities, only SVG embedding is used. Since it is possible to include Javascript in SVGs, this poses a serious security risk. One could for example imagine a case where a student injects code into his submission that then runs on the teacher's end performing actions under the teacher's account. This could be mitigated by using an img-Tag for embedding which does not allow scripting.

nexterday commented 3 years ago

Can you inject/insert javascript in the drawing? try it and let me know.

Re XSS: https://docs.moodle.org/311/en/XSS_trusted_users