foster/forgejo
1
0
Fork 0
mirror of https://codeberg.org/forgejo/forgejo.git synced 2024-11-28 09:21:13 -05:00
Code Issues Wiki Activity
forgejo/tests/integration/fixtures/TestXSSReviewDismissed/review.yml

9 lines
186 B
YAML
Raw Normal View History

[SECURITY] Test XSS in dismissed review It's possible for reviews to not be assiocated with users, when they were migrated from another forge instance. In the migration code, there's no sanitization check for author names, so they could contain HTML tags and thus needs to be properely escaped.
2024-01-17 18:18:39 -05:00
-
id: 1000
type: 1
issue_id: 2
original_author: "Otto <script class='evil'>alert('Oh no!')</script>"
content: "XSS time!"
updated_unix: 1700000000
created_unix: 1700000000
Copy permalink