Skip to content
This repository has been archived by the owner on Jun 18, 2020. It is now read-only.

Rating comments can be arbitrary code #318

Closed
kcrisman opened this issue Dec 19, 2014 · 2 comments
Closed

Rating comments can be arbitrary code #318

kcrisman opened this issue Dec 19, 2014 · 2 comments
Labels
Critical

Comments

@kcrisman
Copy link
Member

E.g., try putting <script>alert('hi there')</script> in the comment box while rating a public worksheet. 'Nuff said. This was reported at http://trac.sagemath.org/ticket/8839.
@kcrisman
Copy link
Member Author

Presumably there is some standard way to sanitize this, even perhaps used elsewhere in the notebook.

@migeruhito migeruhito mentioned this issue Dec 20, 2014
Merged
@kcrisman
Copy link
Member Author

Solved by #323.

@migeruhito migeruhito mentioned this issue Jan 29, 2015
Merged
kcrisman added a commit that referenced this issue Dec 2, 2015
@kcrisman
Merge pull request #324 from migeruhito/autoescape
73ab85c 
Improved solution to #318
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
Critical
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@kcrisman