Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Reflected XSS vulnerability #703

Open
akkuman opened this issue Dec 7, 2019 · 3 comments
Open

Reflected XSS vulnerability #703

akkuman opened this issue Dec 7, 2019 · 3 comments
Labels
Enhancement Enhance performance or improve usability of original features.

Comments

@akkuman
Copy link

akkuman commented Dec 7, 2019 •
edited 

<HEAD></HEAD></xss:xss><svg/onload=alert(1)><svg/onload=alert(/123/)//element[attribute='<img src=x onerror=alert('XSS');>

image
@seonim-ryu seonim-ryu added the Enhancement Enhance performance or improve usability of original features. label Dec 10, 2019
@seonim-ryu
Copy link
Member

@akkuman
The tags corresponding to XSS are sanitized inside the editor, but the above case does not seem to be considered. Thank you for your report.

@LunaTK
Copy link
Contributor

LunaTK commented Dec 12, 2019 •
edited 

<p></p><svg><svg onload=alert('xss')>

Above code is enough to trigger XSS

Also, the original payload didn't work on my Safari 13.0.3, but worked on

  • Chrome 78.0
  • Whale 2.6.88.19
  • Microsoft Edge 80.0 Dev
  • Opera 65.0
  • Firefox 71.0

(Not sure why it doesn't work on Safari, although the rendered DOM is the same.)

I think it is kind of Mutation XSS.

seonim-ryu pushed a commit that referenced this issue Jan 2, 2020
@shiren @seonim-ryu
viewOnly: change event listener should have event object fixed #703
adbedb3
seonim-ryu pushed a commit that referenced this issue Jan 6, 2020
@shiren @seonim-ryu
viewOnly: change event listener should have event object fixed #703
9d049a0
@EvieMae
Copy link

EvieMae commented Mar 31, 2020 •
edited

This still happens in 2.0.0.
Using

<p></p><svg><svg onload=alert('xss')>

@kant01ne kant01ne mentioned this issue Jun 3, 2020
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
Enhancement Enhance performance or improve usability of original features.
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
4 participants
@akkuman @LunaTK @seonim-ryu @EvieMae