TODO project is vulnerable to XSS/HTML injection attacks #1405
Description
Checklist
- I added a descriptive title
- I searched for other issues and couldn't find a solution or duplication
- I already searched in Google and didn't find any good information or help
What happened?
TODO example project is vulnerable to XSS/HTML injection attacks.
Payload Used:
<button onclick='javascript:confirm("vulnerable");document.location.href="https://dmdhrumilmistry.github.io"'>click me</button>Result:
Issue: Since most of the devs will be learning pyscript referring the examples, they'll be making applications which will be vulnerable to XSS/HTML injection. We would appreciate if pyscript team can also use secure coding techniques while creating examples; this will help devs to build secure applications.
What browsers are you seeing the problem on? (if applicable)
No response
Console info
No response
Additional Context
creating a cheatsheet might help devs to avoid such common issues in their applications