search

grundic / teamcity-avatar

Plugin for displaying user avatars in Teamcity
13 stars 4 forks source link

Possible JavaScript injection via username #6

Open yaegor opened 8 years ago

yaegor commented 8 years ago

Alert with "Wow!" can appear on the TeamCity page load if user's display name is set to a special string.

', 'descriptiveName': ''"\'\">', 'extendedName': ''"\'\"> (admin)', 'email': '...' };