🖍 Stop embedding refresh code on pages that don't have View.refresh set

[dodobas]

No description provided.

[nicpottier]

Nice, so what's the vector here for XSS? And is it still present for pages that DO have refresh?

[dodobas]

I'm assuming that an attack only makes sense on public pages (anon users). An attacker could embed code by crafting a special link to execute a script that would steal session of a new user, when they register.

For other pages with refresh, depends on who/what generates the refresh url, if it's a free form user input then yeah, it's still open to exploit

[nicpottier]

ok, ya, seems like a reasonable first step.