search

jkomoros / boardgame

An in-progress framework in golang to easily build boardgame Progressive Web Apps
Apache License 2.0
31 stars 4 forks source link

Audit XSS possbiilities #742

Open jkomoros opened 5 years ago

jkomoros commented 5 years ago

Almost nothing is stored in the database that comes directly from the user (that isn't run through the engine for validity or generated by the engine). Off the top of my head user displayname and other properties are the most likely to need to be escaped if they aren't already