search

medovob / workflowy-for-coders

A Google Chrome extension for WorkFlowy to add markdown support and syntax highlighting in notes
117 stars 18 forks source link

XSS vulnerability #4

Closed Erreinion closed 11 years ago

Erreinion commented 11 years ago

by adding: <script>document.location="http://google.com";</script> I can reliably redirect WorkFlowy when exporting or drilling down into the note.

There is no issue if the code is surrounded by `` or when the extension is disabled.

medovob commented 11 years ago

Thanks. I think its been assumed that all notes will come from a trusted source but given the ability to share and publish lists, this can't be assured. Have you any suggestions to remove this vulnerability?

Perhaps a sanitizer like Caja?

Erreinion commented 11 years ago

There are a few libraries that you can use.

OWASP ESAPI (https://www.owasp.org/index.php/ESAPI)

Check out OWASP's "XSS CheatSheet" for more tips and approaches: https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet