4 ms·
WARNING: DO NOT TRY TO CHAT WITH PEOPLE - BAD THINGS WILL HAPPEN - READ BELOW Uhh, it's possible to inject Javascript into this. There are two people that alre
by owenversteeg 12y ago
WARNING: DO NOT TRY TO CHAT WITH PEOPLE - BAD THINGS WILL HAPPEN - READ BELOW
Uhh, it's possible to inject Javascript into this. There are two people that already did this. One is harmless and alerts "Wufff!" and the other redirects you to pornhub.
[edit] Now there's another that redirects you to lemonparty.
[edit 2] Now there's another that redirects you here. It's fun watching this play out live, with the nice vs. the mean HNers.
- Flam 12y agoThis is a common mistake tons of developers do. Pro-tip: Escape all user input either when it's going into the system or when it's going back out to be displayed!
- fmavituna 12y agoMaybe not everyone knows this, it's called XSS. There is a good cheat sheet to protect against issues like this from OWASP : https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_P... Shameless plug: We develop a tool that detects vulnerabilities such as this automatically (even in JavaScript based web apps) - https://www.netsparker.com/netsparker/ https://www.netsparker.com/netsparker/ There is also a free community edition which would possibly detect this vulnerability : https://www.netsparker.com/communityedition/ https://www.netsparker.com/communityedition/
- ahochhaus 12y agoDrop-In Chat had a few different XSS flaws. They should all be fixed now. Thanks for finding them and pointing them out! Sorry for the slow security fix, I was traveling after leaving YC Hacks. Please do let me know if you find anything else wrong.