Paste is vulnerable to XSS

mkaczanowski / pastebin

Simple, fast, standalone pastebin service

MIT License

155 stars 27 forks source link

Paste is vulnerable to XSS #23

Closed SuperFola closed 3 years ago

SuperFola commented 3 years ago

see https://paste.12f.pl/ckCJatzmaEmb

I just wrote <script>alert("ok")</script>

mkaczanowski commented 3 years ago

Yeah, that needs to be addressed soon (PR's are most welcome)

erkiesken commented 3 years ago

Just made a PR. I hope the javascript plugin output loop was the only place needing special raw output. If you know other template sections that need this, then let me know.

erkiesken commented 3 years ago

@mkaczanowski any chance you can review, merge and release this fix?