fullstorydev / fullstorydev/grpcui
Web UI inputs evaluate HTML and JavaScript content (Cross-Site Scripting vulnerability)
Open
- Dominant language
- JavaScript
- Stars
- 5.9k
- Forks
- 427
- Avg merge
- 3d 6h
- Merged PRs (30d)
- 7
Description
Scripts or HTML content in request fields get evaluated.
Put something like this in a text field:
```js
alert('boom')
```
and the script will be evaluated on focus changes.
HTML content like `
Test
` will be rendered in "Raw Request" tab.Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.