3 ms·
This plugin is vulnerable to XSS -- try entering <script>alert('boom');</script> in the input field of the example.
by adamc 18y ago
This plugin is vulnerable to XSS -- try entering <script>alert('boom');</script> in the input field of the example.
- riklomas 18y agoYou can use the options to set the output as text() rather than html(), e.g. $('div').magicpreview('mp_', { 'change': 'text' }); But yes, I should really add a flag to strip out any script elements :)
- technoguyrob 18y agoXSS detection is not just as simple as that. For example, in IE, entering the following produces a pop-up: <table style="background-image:url(javascript:alert(1))"><tr><td>Hi</td></tr></table> However, read debt's comment below. XSS is irrelevant here since "XSS" means cross-site scripting, i.e., ,managing to embed Javascript into pages someone ELSE sees. Only the client sees this, it doesn't get reproduced for anyone else.
- debt 18y agoThis is only on the front end. If the backend filters html tags then XSS won't be a problem.
- adamc 18y agoFiltering tags is notoriously difficult, though, because of the variety of encodings possible. Maybe you meant "properly encodes output"? That's the typical solution.