4 ms·
Am I reading this right that there is absolutely no HTML escaping for app descriptions on the Android Market? Seriously Google, like none?
by mustpax 16y ago
Am I reading this right that there is absolutely no HTML escaping for app descriptions on the Android Market? Seriously Google, like none?
- nbpoole 16y agoWas. It's fixed now, apparently ;)
- NathanKP 16y agoSomeone at Google probably got in trouble over this.
- beaumartinez 16y agoRemember when YouTube had a similar issue with <script> tags executing from within comments?
- nbpoole 16y agoIt wasn't quite that simple ;-) http://www.reddit.com/r/programming/comments/cluc5/html_injection_vulnerability_in_youtube_comments/ http://www.reddit.com/r/programming/comments/cluc5/html_inje... The payload in the case of YouTube was only slightly more complex (two <script> tags instead of one), but it sounds like the underlying cause was very different. --- Many websites and web applications are vulnerable to XSS in one form or another. The difference here, as people have pointed out, is the trust placed in the site by Android. It's not very often that an XSS vulnerability can execute arbitrary code on a remote system. :-P
- Getahobby 16y agoI think the underlying cause was the same - unescaped output that was supplied by the (malicious) user.
- nbpoole 16y agoMmm, from here it looks like YouTube had a sanitizer in place that failed: it's not clear that the Android Market was sanitizing the output here. That's what I meant by the underlying cause being different.