search

theheapdump / kite-webapp

web-app for kite trading-bot platform
0 stars 1 forks source link

Bug: tampering the input for Login gives a weird Error message in UI #147

Open bevanamit opened 3 years ago

bevanamit commented 3 years ago

Open TB intercept using burp changed Login password to {$exists": true} to inject mongodb

tradebull.log

image

theheapdump commented 3 years ago

Since this is not a normal activity -

  1. Here the aim should be to test a. Nothing is leaked from the DB b. No internal information / exception / stack-trace / sensitive information on the UI or network tab

BURP interceptions response on UI is not a priority to fix

If the above are OK - move this to label : "validation-backlog" and let it be open

theheapdump commented 3 years ago

THis should be fixed now as validation is in place. Please retest this .

bevanamit commented 3 years ago

faced same issue again

![Uploading image.png…]()