Forum Discussion

sateesh999's avatar
sateesh999
Contributor
7 years ago

How to prevent cross-site-scripting and XSS?

How to prevent cross-site-scripting and XSS? We are getting messages from unknown users like the below: [ <img src=x onerror=prompt('xss by codejump');>  <img src=x onerror=prompt(/securitytestin...
Views
Sign in to react to this post
luk's avatar
luk
Boss
6 years ago

sateesh999 I just tried your steps above and can't reproduce it, the input in the subject field gets HTML encoded, e.g. if I look at the source it is as below:

		<h2 itemprop="name" class="message-subject">
			<span class="lia-message-read">
				
						<a class="page-link lia-link-navigation lia-custom-event" id="link_2" href="/t5/<boardid>/lt-img-src-x-onerror-prompt-alittlexss-gt/td-p/1326">
							&lt;img src=x onerror=prompt(/alittlexss/)&gt;
							
						</a>
					
			</span>
		</h2>

- I posted trough /t5/forums/postpage/choose-node/true, is that the same URL for you where you see the behavior?

- Is your "view all topics" page customized by you, e.g. do you aggregate the topics by yourself via API or are you using out of the box components?

Sign in to react to this post
luk's avatar
luk
Boss
6 years ago

sateesh999 did some more digging into this and came up with another question for you: How you you render/output that "view all topics"-component? Is it custom? And if so, is it rendered via JavaScript (Angular, jQuery, whatever) directly from the JSON of an API response?

Sign in to react to this post