XSS Issues

[nlipke]

I found 3 area with XSS.

1. Create an Model with a name of <script>alert('a')</script>
   1a. Click Delete the alert pops up twice
   1b. Add an asset and click on the models drop down the alert shows up
2. Create an Asset with a name of <script>alert(1)</script>
   2a. Click Delete, the alert shows up twice

[nlipke]

I found another one. Set the user's first name to <script>alert('x')</script> and you'll get an alert on pretty much every page.

[nlipke]

Group name too.

[nlipke]

Asset tag still has the issue

[snipe]

I spent some time with this this evening because it was bugging the shit out of me. Weird thing is, the content WAS being escaped on the way out (as you could see from the HTML of course). jquery was actually doing Very Bad Things and sort of re-assembling it.

I ended up backing out my alpha_dash changes from earlier, since the laravel validator (stupidly) doesn't have a version of alpha_dash that also allows spaces, and without it, it's too constrictive. I'll be writing a custom validator to reject funky characters at some point soon.

Thanks for drawing my attention to this. Was a real titty-twister for much of the night, since I could see the HTML was being escaped.