Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix Stored XSS #19

Merged
merged 1 commit into from
Nov 12, 2023
Merged

Fix Stored XSS #19

merged 1 commit into from
Nov 12, 2023

Conversation

gtsp233
Copy link
Contributor

@gtsp233 gtsp233 commented Nov 12, 2023

Hi, I've discovered a stored Cross-Site Scripting (XSS) vulnerability in your GitHub repository:

Vulnerability Details:
Version Affected: All versions
Severity: [High/Critical – Stored XSS can have a significant impact. Adjust based on your assessment]
Description: The vulnerability allows malicious attacks to inject scripts through a direct network request. Once embedded, any user viewing the posts' description will execute the malicious script.

Steps to Reproduce:
Send a direct POST or PUT request (bypassing the user interface) to /api/posts with a payload description containing the malicious script.
After the post is successfully created or edited, any user who views the post list or the specific post's details will run the malicious script.

Suggested Fix or Mitigation:
Server-side: When creating the post, it's essential to sanitize the user's input (description) before processing it to ensure malicious scripts are neutralized.
Client-side: Prior to displaying the post's description using dangerouslySetInnerHtml, ensure that the description is sanitized using libraries like DOMPurify to prevent script execution.

Attached Screenshot
Screenshot 2023-11-11 at 20 59 38

@itsnitinr
Copy link
Owner

Thank you for taking your time to detail this out and for the fix. I really appreciate it.

@itsnitinr itsnitinr merged commit 782f64c into itsnitinr:main Nov 12, 2023
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants