search

utterance / utterances

:crystal_ball: A lightweight comments widget built on GitHub issues
https://utteranc.es
MIT License
8.66k stars 567 forks source link

Leaking session / authorization in the urls posted in new comment bodies #649

Open darraghoriordan opened 1 year ago

darraghoriordan commented 1 year ago

Hey,

It looks like the link that is posted in new issue bodies leaks the session of the first commenter?

I can click on that link, and if the person is still logged in to github via utterances, i can post a comment as them.

The link that the bot creates for issue bodies should not include the "utterances=" query string containing the session??

darraghoriordan commented 1 year ago

image

That link should not have the "utterances=" query param

yiyb0603 commented 7 months ago

Did you solve problem? I have still issue too.

darraghoriordan commented 7 months ago

Did you solve problem? I have still issue too.

Hey, I didn't. I just removed it from my site.