vue-advanced-chat icon indicating copy to clipboard operation
vue-advanced-chat copied to clipboard

Published 20 hours ago • verified publisher icon advanced-chat

Prevent XSS

Open NTVNgan opened this issue 2 years ago • 11 comments

Describe the bug

Currently we has not apply yet any protection from XSS exploit as below.

Steps to reproduce

  1. Boxchat write '<img src=x onerror=alert('hi') />'
  2. Broswer show alert hi beacause in code use v-html

Expected behavior

Prevent XSS

Screenshots

xss

Device (please complete the following information)

Package version: 1.5.7

NTVNgan avatar Oct 13 '22 08:10 NTVNgan

Yes I am aware of this issue, thanks for pointing it out. I will fix it shortly

antoine92190 avatar Oct 13 '22 11:10 antoine92190

you can use https://www.npmjs.com/package/dompurify to prevent xss

chriswalg avatar Dec 08 '22 18:12 chriswalg

issue is not closed for me. I can reproduce xss.

chriswalg avatar Dec 01 '23 21:12 chriswalg

Hey @chriswalg, what version of vue-advanced-chat are you using?

aerovulpe avatar Dec 02 '23 16:12 aerovulpe

I tested on 2.0.8 and 2.0.10

chriswalg avatar Dec 02 '23 16:12 chriswalg

Please share the text content you used to trigger the XSS.

I've tested with <img src=x onerror=alert('hi') /> on the demo app to verify the rendered HTML is sanitized, and it seems to be correct.

image

aerovulpe avatar Dec 02 '23 16:12 aerovulpe

you are right, it cannot be reproduced in the large chat window in which all messages are displayed. i can only reproduce it in the small chat window.

chriswalg avatar Dec 02 '23 17:12 chriswalg

Please share a screenshot. Also, what do you mean by the small chat window? Thanks!

aerovulpe avatar Dec 02 '23 17:12 aerovulpe

brave_screenshot_localhost (6)

chriswalg avatar Dec 02 '23 17:12 chriswalg

on https://vue-advanced-chat-app.netlify.app/chat is xss also reproducable.

chriswalg avatar Dec 02 '23 17:12 chriswalg

Hey @antoine92190, I don't think https://vue-advanced-chat-app.netlify.app/chat has been updated to the latest library version. Also, I'm not familiar with the small chat window view @chriswalg is referencing. If it's using src/components/FormatMessage/FormatMessage.vue, then it should also prevent XSS with the sanitized Markdown-generated HTML.

aerovulpe avatar Dec 02 '23 22:12 aerovulpe