Escape HTML in messages extracted from Validator NU output

w3c / Unicorn

Unicorn - W3C's Unified Validator

https://validator.w3.org/unicorn/

Other

127 stars 59 forks source link

Escape HTML in messages extracted from Validator NU output #212

Closed dontcallmedom closed 3 years ago

dontcallmedom commented 3 years ago

Fix XSS risk

@jean-gui I haven't tested it and am light years away of being in a position to test it, so your help in verifying this fix the bug and in deploying it if it does would be greatly appreciated

echo0x00 commented 3 years ago

@dontcallmedom @jean-gui I was the one who reported the vulnerability. I'm sorry if my words are inappropriate. But I was unable to deploy the unicorn and check the suggested edits. Everything worked perfectly, XSS on my Payloads are no longer observed. HTML is escaped. You can check it here: http://80.211.182.47:8081/unicorn/

dontcallmedom commented 3 years ago

@savproga many thanks for verifying the patch! I'll work with @jean-gui in getting it deployed then.