Multiple reflected XSS

[tsparksh]

Please describe the problem (or idea)

What happened just before the problem occurred? Or what problem could this idea solve?

While taking the input for the comment, filtering of input does not happen so that XSS script is executed.
Payload I've used: <img src=x onerror=prompt('xss')>

Please show us where to look

• https://publiclab.org/blog/%3Cimg%20src=x%20onerror=prompt('xss')%3E (add sanitize string functions to blog page #10343)
• https://publiclab.org//tag//%3C%2Ftitle%3E1%3Cimg%20src=x%20onerror=prompt('xss')%3E
• https://publiclab.org/maps/tag/%3Cimg%20src=x%20onerror=prompt('xss')%3E sanitize contributors template #10345
• https://publiclab.org/contributors/%3Cimg%20src=x%20onerror=prompt('xss')%3E sanitize tab content #10344
• (This one and No. 6 are a bit different than other, because we need to escape from html comment before payload) https://publiclab.org/questions/tag/--%3E%3Cimg%20src=x%20onerror=prompt('xss')%3E
• https://publiclab.org/wiki/tag/--%3E%3Cimg%20src=x%20onerror=prompt('xss')%3E sanitize contributors template #10345

Please have a look at this link for more information on XSS.
Filter the input containing Script tags like <,>-,% and all other payload inputs

---

Thank you!

Your help makes Public Lab better! We deeply appreciate your helping refine and improve this site.

To learn how to write really great issues, which increases the chances they'll be resolved, see:

https://publiclab.org/wiki/developers#Contributing+for+non-coders

[tsparksh]

This issue may be helpful #3549

[jywarren]

This is a great catch! Would you be able to suggest a fix based on #3549? Or to open a PR?

…

On Tue, Jan 7, 2020 at 5:39 AM Sparks ***@***.***> wrote: This issue may be helpful #3549 <#3549> — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#7133?email_source=notifications&email_token=AAAF6J7J6JPCPFCEB5RTOMLQ4RLXJA5CNFSM4KDWYTFKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEIIOMEA#issuecomment-571532816>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAAF6JZF26HOY2CEP3UCSMDQ4RLXJANCNFSM4KDWYTFA> .

[Uzay-G]

We can use built-in Rails sanitizers for this.

[jywarren]

Here, each template with the above vulnerabilities could be resolved by replacing:

<%= params[:potentially_unsafe_user_generated_content]%>

with

<%=h params[:potentially_unsafe_user_generated_content]%>

Yeah!

[jywarren]

I think i got them all and made FTOs from them. 5 and 6 should be tested one more time on stable.publiclab.org once they merge!