Cross-Site Scripting: Reflected
Open
- Dominant language
- Java
- Stars
- 446
- Forks
- 128
- PR merge metrics
- No merged PRs in 30d
Description
https://github.com/didi/sds/blob/0ac9dbe98b6e019bede3517dc333cf2a9e3c4013/sds-admin/src/main/java/com/didiglobal/sds/admin/controller/HeartbeatController.java#L71-L73
There may be special characters in ‘’request.getParameter("client")‘’.Sending unvalidated data to a web browser can result in the browser executing malicious code.
Contributor guide
Assessment
This issue has not been assessed yet.