cryptosharks131
Code Injection in Peer Alias
I have a channel with a node that has the following alias: <script>alert(\"LDK\");</script>
On the lndg overview page, the alias field just remains empty. But when I click on the channel ID in the list of active channels, an alert pops up.
I accidentally created a duplicate: https://github.com/cryptosharks131/lndg/issues/394 Anyway mine is better explained with images.
Almost 9 months after this, we are still waiting for a patch. This software seems to be adandonware at this point.
Almost 9 months after this, we are still waiting for a patch. This software seems to be adandonware at this point.
Have you submitted a pull request with a fix that wasn't merged? No?
This should now be resolved in the latest v1.9.0 branch. Can you verify if you are still able to replicate the issue with this branch?
For now, focused on the alert that is generated from the example script execution but not that it is still displayed properly.
Do you also still see the alert being generated?