HTML input is not sanitized

[gianklug]

You can use any HTML as and can even inject javascript by using <img src="broken" onerror="your_js_code"></img>. If many users are using snapweb, this could be considered a security issue.

[badaix]

Where and how you can use any HTML?

[gianklug]

In the Device nickname field

[badaix]

True, seems that the readme is still valid :)

This web client is the author's first JavaScript/TypeScript project and is rather a proof of concept for the Snapserver's WebSocket API.

[nanderer]

is this issue mentioned only reflecting to client side java script or even to server side?

[gianklug]

I didn't check the server part, however I am able to display javascript alerts or open popups on a friends pc using snapweb like this.

nanderer @.***> schrieb am Mo., 10. Jan. 2022, 00:31:

is this issue mentioned only reflecting to client side java script or even to server side?

— Reply to this email directly, view it on GitHub https://github.com/badaix/snapweb/issues/36#issuecomment-1008446645, or unsubscribe https://github.com/notifications/unsubscribe-auth/AMGSKD5BOJQHKT6NVHQENF3UVILGDANCNFSM5IMGDBEA . You are receiving this because you authored the thread.Message ID: @.***>

[badaix]

The server doesn't interpret any JavaScript, it just serves files within the doc root directory