Skip to content

Conversation

@kubeeek
Copy link

@kubeeek kubeeek commented Mar 15, 2020

Any input from user should be escaped or sanitized. Now it's possible to send malicious code across clients (XSS exploit), for an example try to send <script>for(var i = 0; i < 99999; i++) { console.log(i) }</script>, it will crash CEF. I have added simple regex replace, so:

<script></script>

becomes:

scriptscript

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant