quadratic-funding / mpc-phase2-suite

The MPC suite of tools for conducting zkSNARK Phase 2 Trusted Setup ceremonies
MIT License
16 stars 6 forks source link

feat(security) - Added input sanitization #368

Closed ctrlc03 closed 1 year ago

ctrlc03 commented 1 year ago

Added HTML encoding to data sent by coordinators on ceremony setup and user creation. Should any user register, or coordinators create ceremonies with XSS payloads in the description fields, this data will be HTML encoded. This prevents third-party frontends from executing this code should they expect it to be already sanitized