DNNCommunity / DNNCommunity/DNN.Blog
Comments are not HTML encoded
Open
bug
- Dominant language
- JavaScript
- Stars
- 39
- Forks
- 41
- PR merge metrics
- No merged PRs in 30d
Description
This leaves the commenting system open to XSS attacks and HTML injection.
Before saving a comment to the database, it should be encoded.
Contributor guide
Assessment
This issue has not been assessed yet.