5 ms·

http://fluin.com/?search=%22%3E%3Cscript%3Ealert%28%27XSS%27%29%3C/script%3E&sortby=top&time=86400 http://fluin.com/?search=%22%3E%3Cscript%3Ealert%28%27XSS%27.

• fluin 16y ago
  thanks! I'll have that fixed
• nbpoole 16y ago
  And another: http://bit.ly/eN40yI http://bit.ly/eN40yI Edit: Using a bit.ly link, since HN's URL parser is leaving out the closing ].
  • fluin 16y ago
    but that doesn't work?
    • nbpoole 16y ago
      It does. If you look closely, you'll see that HN's URL parser ignored the ] at the end of the URL. If you click on the URL and then add a ] to the end of it, your JSON will be valid and you'll see two alert boxes. Edit: But yeah, my bad for not noticing that earlier. I've swapped it out for a bit.ly link now, so it works properly. I'm headed to sleep. :)
      • fluin 16y ago
        It shouldn't affect the feed though (at least it doesn't seem like it)
        • nbpoole 16y ago
          That isn't the goal of an XSS attack. :P http://en.wikipedia.org/wiki/Cross-site_scripting http://en.wikipedia.org/wiki/Cross-site_scripting
• fluin 16y ago
  Thanks for your help!
• fluin 16y ago
  This one is fixed :)
  • nbpoole 16y ago
    It actually isn't. This example won't execute on page load, but it will if someone clicks in the search box. http://fluin.com/?search=Search%22%20onclick=alert%28document.cookie%29%20onfocus=%22 http://fluin.com/?search=Search%22%20onclick=alert%28documen... Since you're using PHP, I recommend you use a function like htmlspecialchars here rather than whatever kind of filtering you're doing.