Security issue: XSS (cross-site scripting)

seyhunak / twitter-bootstrap-rails

Twitter Bootstrap for Rails 6.0, Rails 5 - Rails 4.x Asset Pipeline

https://github.com/seyhunak/twitter-bootstrap-rails

4.5k stars 999 forks source link

Security issue: XSS (cross-site scripting) #856

Open claudiob opened 9 years ago

claudiob commented 9 years ago

Looks like https://github.com/seyhunak/twitter-bootstrap-rails/commit/23c2050c5fd0c0aff26484673703c4455993550a is taken as example in a RailsConf talk about what not to do in a gem to avoid cross-site scripting. Take a look at https://youtu.be/dof0EspDPlU?t=24m4s – what do you think?

panmari commented 8 years ago

As argued in the talk, I think escaping should happen at the user level if desired. I created a pull request reverting this change and added two tests.

forced-request commented 8 years ago

@seyhunak This is quite concerning because this vulnerability was addressed in 2014.

Read about it in this blog post: https://nvisium.com/blog/2014/03/28/reflected-xss-vulnerability-in-twitter/

Relevant commit: https://github.com/seyhunak/twitter-bootstrap-rails/commit/663760e67b80ee25adc293bf5f03debae28b5af9