Cross-site Scripting (XSS) vulnerability

[stypr]

Expected Behavior

https://(domain)/prefix/(node)/ipv4?q=%22%2balert(document.domain)%2b%22

Example from the domain: https://(domain)/prefix/(node)/ipv4?q=%22%2balert(document.domain)%2b%22

Actual Behavior

Arbitrary Javascript Code alert(document.domain) is executed.
This can leverage to leak cookies, or even run malicious code on the victim's browser.

[zorun]

Looks like the same issue as #63, fixed in #82 one year ago? Can you confirm?

[stypr]

Seems like the same issue was described back in #18

I've installed the latest version and it seems to be fixed.

I found this issue while testing some servers on the internet, but I couldn't confirm as there was no current version displayed on the service

Thanks !