[ANTARCTICLE-150] <script> text isn't shown in articles and comments - JTalks JIRA

Voters

Watchers

XML

Word

Printable

Steps:
1. Go to http://uat.jtalks.org/antarcticle/ and sign in
2. Click "Write article"
3. Enter <script>alert('aa')</script>
4. Click "Post article"

Actual Result: appears alert('aa');
Expected Result: appears <script>alert('aa')</script> (like in JCommune)

Note, that the same behaviour reproduces in the comments fields.

duplicates

ANTARCTICLE-192 XSS vulnerability in comments

Testing discovered

ANTARCTICLE-195 Script doesn't shown on Read Article if posted without markdown