alexcrack / alexcrack/angular-ui-notification

Add protection against XSS

Open
#86 1 comment 1 reaction 0 assignees View on GitHub
Dominant language
JavaScript
Stars
529
Forks
164
PR merge metrics
No merged PRs in 30d

Description

In my app the following code opens a dialog box with "hi" :
`Notification.success("Some message alert('hi')")`

It shows that my app was vulnerable to XSS because Notification was used in that sort of way : `Notification.error("got an error : "+myError);`

And myError is a string that can come from anywhere, and is unsecure.

My fix was to decore Notification service and apply $sanitize on strings.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.