New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
XSS Concern #78
Comments
|
the data from the search query is not always simply output to the screen,
so to escape it there would not be wise. escaping should be done when the
data is output. we'd consider pull requests if you want to add escaping to
the output.
…On Mon, Mar 12, 2018 at 1:44 PM, Williada-lbcc ***@***.***> wrote:
Hello,
I've hit a couple of XSS issues with search result pages using the Solr
Pro Farcry plugin. Escaping the 'q' variable with "encodeForHTML()" does a
great job, but I was notified this morning that I hadn't found the bottom
of the turtle stack and was escaping an href as well.
I don't mind digging through code, but perhaps it would expedite to ask if
there is a single place we could escape the search query before it's
branched off to all the code it is passed to?
Thanks for any assistance.
—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub
<#78>, or mute the
thread
<https://github.com/notifications/unsubscribe-auth/AAfJ5RQSRNVszwyQ5TVertOBcZRMb78Lks5tdrQUgaJpZM4SnFsd>
.
--
Sean Coyne
n42 Designs
sean@n42designs.com
http://www.n42designs.com/
http://about.me/seancoyne
|
|
/search?q=cat<%0Dscript>alert(%27XSS%27)<%0D/script> I currently have this which seems to fix it Update: |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Hello,
I've hit a couple of XSS issues with search result pages using the Solr Pro Farcry plugin. Escaping the 'q' variable with "encodeForHTML()" does a great job, but I was notified this morning that I hadn't found the bottom of the turtle stack and was escaping an href as well.
I don't mind digging through code, but perhaps it would expedite to ask if there is a single place we could escape the search query before it's branched off to all the code it is passed to?
Thanks for any assistance.
The text was updated successfully, but these errors were encountered: