5 ms·
As a curious noob, could u explain what is the source of the XSS vulnerability in this case? Is it simply that the site isn't being served over tls/ssl?
by g_delgado14 11y ago
As a curious noob, could u explain what is the source of the XSS vulnerability in this case? Is it simply that the site isn't being served over tls/ssl?
- rohanprabhu 11y agoNot sanitizing input, by either scrubbing out any <script> tags, or escaping those characterst to html entities.
- kolme 11y agoPlease don't "sanitize" input, just escape accordingly. "<script>" might be a legitimate input.
- eterm 11y agoYou need both. Sometimes the legit input is HTML such as from rich text editors. In those cases if someone types a bold <script> then the form should submit the escaped <b><script><b> but also needs to sanitise to make sure that other HTML element types are not present. If you escape one step further you'll lose formatting or the message, so sanitisation is important too, it is reductive to say "always escape never sanitise".
- windsurfer 11y agoI think your first problem is whitelisting HTML entities. Unless you're composing HTML-formatted email, it's usually better to use a different markup syntax like a minimal markdown or asciidoc that can safely be escaped.
- eterm 11y agoI agree, although for non-technical users, the better wysiwyg editors are still HTML based, unless you have a recommendation for an in-browser wysiwyg editor that returns/exports markdown?
- deleted 11y ago[deleted]