search

nandi95 / vue-toastify

🔥 Simple, extendable, dependency free notification plugin. 🔥
https://vue-toastify.netlify.com/
MIT License
227 stars 12 forks source link

url option is vulnerable to XSS (Cross Site Scripting) #26

Closed bunnypouts closed 2 years ago

bunnypouts commented 3 years ago

The url option is vulnerable to XSS. filter the url properly to prevent XSS for more on this please visit https://owasp.org/www-community/xss-filter-evasion-cheatsheet There should be events to handle javascript execution.

image

nandi95 commented 3 years ago

Thanks for the issue! It seems this can be fixed by adding encodeURI here and here

PRs are welcome if not I will release a fix as soon as possible, in the meantime the same encodeURI can be done by the developer who uses the package.