search

ripple / ripplecharts-frontend

RippleCharts front-end using Angular.js and D3
ISC License
185 stars 131 forks source link

Stored XSS in transaction explorer #188

Closed WietseWind closed 6 years ago

WietseWind commented 6 years ago

Transaction:

{
  "TransactionType": "Payment",
  "Account": "rPdvC6ccq8hCdPKSPJkPmyZ4Mi1oG2FFkT",
  "Fee": 10,
  "Destination": "rPEPPER7kfTD9w2To4CQk6UCfuHM9c6GDY",
  "DestinationTag": 495,
  "Amount": 1234,
  "Memos": [
    {
      "Memo": {
        "MemoData": "48692C206A757374203C623E74657374696E673C2F623E203B29"
      }
    }
  ]
}

The MemoData is the HEX representation of (utf8 to hex): Hi, just <b>testing</b> ;)

Sample: https://xrpcharts.ripple.com/#/transactions/0180D1F07F31240E1D4E7503913885672E3227D8CC41600B4BD054FF01D6B2B6

The decoded hex is bold: image

shekenahglory commented 6 years ago

fixed https://github.com/ripple/ripplecharts-frontend/commit/c0bf7032f9c115527562b3ef255fef18a91574ef