Closed pwnetrationguru closed 10 years ago
parseFromString rule misses the following dangerous example:
doc = parser.parseFromString(someVar, "text/html");
While not actually dangerous until you add this node to a document, I've added a rule for this in the newscanner since its probably worth highlighting in a review situation.
parseFromString rule misses the following dangerous example: