xss attacks has been executed

rmrevin / yii2-comments

Yii 2 comments extension

MIT License

52 stars 19 forks source link

xss attacks has been executed #18

Open SerikK opened 7 years ago

SerikK commented 7 years ago

Hi! I have detected that there is xss attack not prevented. I guess because of these code ` $comments[$Comment->id] = $Comment->attributes;

$CommentListWidget ->getView() ->registerJs('jQuery("#' . $CommentListWidget->options['id'] . '").yiiCommentsList(' . Json::encode($comments) . ');');` As can be seen from these codes there seems to be no encoding of each attributes in Comment object.

rmrevin commented 7 years ago

Hi. Thanks for issue. We need a unit test to fix the problem.