pawelrojek / nextcloud-drawio

Draw.io intergration app
https://apps.nextcloud.com/apps/drawio
GNU Affero General Public License v3.0
227 stars 60 forks source link

Check for stored XSS vulnerability in draw.io < 18.0.0 #178

Open davidjgraph opened 2 years ago

davidjgraph commented 2 years ago

Versions of draw.io prior to 18.0.0 are susceptible to the stored XSS attack described at https://huntr.dev/bounties/033d3423-eb05-4b53-a747-1bfcba873127/ if they do not have an appropriate CSP to block unsafe-inline script.

I don't know if this project bundles draw.io, but if it does I would test against the test case and update to 18.0.0 is found to be susceptible.