search

totaljs / cms

Node.js Content Management System
http://www.totaljs.com/cms/
MIT License
228 stars 92 forks source link

escape html special chars in name attribute #36

Closed caverav closed 2 years ago

caverav commented 2 years ago

I have escaped the html special characters from the name attribute in particular, however this should be done with all user-controllable inputs, this should close #35.

Now if you try to put the POC mentioned in the issue ("><img src=x onerror=alert(1)>) you will see the following:

image

P0cas commented 2 years ago

I have confirmed for that

petersirka commented 2 years ago

I have a better fix. It will be soon.