Stored XSS in text fields

[icyphox]

There’s a stored XSS bug in the comments section under each proposal, allowing the attacker to run malicious JS on the client.

Steps to reproduce

1. Hit "add a comment", found under any proposal
2. Enter <script>alert(1)</script> in the text field
3. An alert-box should pop up with 1 in it

Relevant screenshot

This was tested on the latest commit (d3744d4) on a local development server.

Note: I haven't tested this on production.

[zerothabhishek]

Thanks for reporting this @icyphox

[zerothabhishek]

Tested on staging server (junction.h65.in), problem exists

[icyphox]

Am I permitted to test on that URL as well? I'm having some issues with the local setup.

[zerothabhishek]

Sure go ahead @icyphox

[zerothabhishek]

Possible cause: the markdown filter used in views allows malicious JS to pass. A better way seems to be to use markdown_safe instead. Another possible technique is to use markdown|safe|striptags filters.

[zerothabhishek]

Hey @icyphox could you please help us with testing the fix at #587 ?
Staging: junction.h65.in

[icyphox]

I'm away from my computer at the moment, I'll do this tomorrow.

Bear with me :)

[icyphox]

@zerothabhishek I'm having trouble logging in on the staging server. GitHub OAuth doesn't seem to work nor does the email confirmation when I try to login via email.

[zerothabhishek]

@icyphox yeah emails are not working on that server (OAuth has also not been setup). You can perhaps use the admin to mark the account as verified. Sending credentials via email

[icyphox]

Looks good from my end. Input appears to be sanitized server-side as well. Great!

[zerothabhishek]

Thanks @icyphox