Closed MorpheusXAUT closed 7 years ago
It looks like some sort of sanitization is already done, presumably by the quill editor or vue... A few tests were not able to run any alerts or logs, so it might be enough already. This will need to be monitored though...
Postponed for now.
Sinus wasn't able to trigger any sort of vulnerability by manually spamming the site with garbage data or common attacks. This issue will be closed for now, since it appears the site is secure enough.
Since many fields (especially in the mission details) allow for content to be displayed as HTML, we have to add HTML sanitizing to prevent malicious code being executed or user information stolen via mission descriptions or likewise.
An example package for achieving this would be sanitize-html.
This should definitely be added before the beta version of slotlist.info goes live and users start creating custom missions.
Tasks
sanitize-html
in backend model saving