search

klnusbaum / UDJ-Server

The Social Music Player!
www.udjplayer.com
GNU General Public License v2.0
43 stars 17 forks source link

Url Injection Attack Vulnerability #43

Closed klnusbaum closed 12 years ago

klnusbaum commented 12 years ago

The function geocodeLocaiton in the file player.py is vulnerable to a url injection attack. The json inputs are never scrubed and fed directly into the url query.

klnusbaum commented 12 years ago

The function was moved. It's called USCWebGISGeocoder and it's in geocoders.py

klnusbaum commented 12 years ago

Fixed, we santize the inputs now.