4 ms·
I can add a script tag via the CSS. I suppose it's not much of a security risk. Might be wrong though: https://brick.do/c9878660-42ed-4b95-93b6-10a761488b5a htt
by haberdasher 6y ago
I can add a script tag via the CSS. I suppose it's not much of a security risk. Might be wrong though: https://brick.do/c9878660-42ed-4b95-93b6-10a761488b5a https://brick.do/c9878660-42ed-4b95-93b6-10a761488b5a
- firloop 6y agoOof. Depending on how they store authentication data, it might be possible to get someone's session token. Let's hope the cookies are "HttpOnly".
- arkadiyt 6y ago> I suppose it's not much of a security risk. It wouldn't be much of a security risk if the authors had correctly isolated user content into its own origin, which would have made this a self-xss only. As it stands the app itself runs on the same origin, so this is a real XSS.
- neongreen 6y agoThanks! Isolating user content is the next task on the list — we discussed it internally just yesterday. Unfortunately, we didn't think we'll need it /that/ soon. Long-term, we definitely need more security-minded folks on the team. Short-term, I will add an email address in the footer so that such issues can at least be reported privately.
- neongreen 6y agoDeployed a fix. Thanks!