search

varol-adem / juice-shop

OWASP Juice Shop: Probably the most modern and sophisticated insecure web application
https://owasp-juice.shop
MIT License
0 stars 0 forks source link

Fix code scanning alert - Semgrep Finding: javascript.browser.security.insecure-document-method.insecure-document-method #8

Closed varol-adem closed 9 months ago

varol-adem commented 9 months ago

XSS gerçekleştiriliyor. Tracking issue for:

varol-adem commented 9 months ago

function escapeHtml(unsafe) { return unsafe .replace(/&/g, "&") .replace(/</g, "<") .replace(/>/g, ">") .replace(/"/g, """) .replace(/'/g, "&#039"); }

textBox.innerHTML = snarkdown(escapeHtml(hint.text));

Gibi bir kodla düzeltilebilir.