Uploaded image for project: 'Antarcticle'
  1. Antarcticle
  2. ANTARCTICLE-192

XSS vulnerability in comments

VotersWatchers
    XMLWordPrintable

    Details

    • Type: Bug
    • Status: Closed (View Workflow)
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: 2.0
    • Fix Version/s: 2.0
    • Labels:

      Description

      Steps to reproduce:
      1. Log into antarcticle
      2. Open an article
      3. Enter <script>alert("test")</script> comment, click "Post"

      Actual result: alert window pops-up
      Expected result: no pop-up window is shown, script is saved as a text

        Attachments

          Issue Links

          blocks

          Bug - A problem which impairs or prevents the functions of the product. ANTARCTICLE-160 Fix html errors (w3c)

          • Minor - Minor loss of function, or other problem where easy workaround is present.
          • Closed
          is duplicated by

          Bug - A problem which impairs or prevents the functions of the product. ANTARCTICLE-150 <script> text isn't shown in articles and comments

          • Minor - Minor loss of function, or other problem where easy workaround is present.
          • Closed
          relates to

          Bug - A problem which impairs or prevents the functions of the product. ANTARCTICLE-195 Script doesn't shown on Read Article if posted without markdown

          • Minor - Minor loss of function, or other problem where easy workaround is present.
          • Closed

            Structure

              Activity

                People

                • Assignee:
                  Vtech Targa Florio
                  Reporter:
                  Vtech Targa Florio
                • Votes:
                  0 Vote for this issue
                  Watchers:
                  3 Start watching this issue

                  Dates

                  • Created:
                    Updated:
                    Resolved:

                    Structure Helper Panel