Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
In the views ClientSecret and ApiResourceSecret is not HTML encoded data attribute data-secret-value on the button:
ClientSecret
ApiResourceSecret
data-secret-value
<td><button class="secret-value-button btn btn-outline-primary" data-secret-value="clientSecret.Value"><i class="fa fa-eye"></i></button></td>
This data attribute is used in the dialog with secret detail.
Fix:
<button class="secret-value-button btn btn-outline-primary" data-secret-value="@Html.Encode(clientSecret.Value)"><i class="fa fa-eye"></i></button>
I will send this fix asap.
Thanks to Silton Santos for reporting.
The text was updated successfully, but these errors were encountered:
fix XSS in ApiSecrets and ClientSecrets skoruba#813
8d1b8fa
Fixed
Sorry, something went wrong.
skoruba
No branches or pull requests
In the views
ClientSecretandApiResourceSecretis not HTML encoded data attributedata-secret-valueon the button:This data attribute is used in the dialog with secret detail.
Fix:
I will send this fix asap.
Thanks to Silton Santos for reporting.
The text was updated successfully, but these errors were encountered: