Remake

This is a plan to start Lock from scratch, changing everything (including the name).
This will be updated as more things are added, feel free to comment on the changes.

Roadmap

API-Based

• Two completely separate things.
  • Client (makes request to API)
  • API (updates DB and returns encrypted JSON data back to client)
• API over generating HTML

Security

• Encrypted data sent to client, which has the ability to decrypt data and present to user
• Client sends encrypted data
• Server does not have access to any raw data

Images

• Send images instead of just text

Use Cases

• Sending wifi passwords 😉
• Make a giveaway
  • First person to click the link included in the message wins!
• Simple messaging with friends

Designs

• A list of designs will be available here soon

Goal

• Provide an easy way to send self destructing messages.
• Not responsible if user sends sensitive data that is screenshotted

I need to recode everything as the methods used in this just aren't efficient. :(

Hi KingPixil,

Lock is vulnerable to stored XSS, a form of code injection wherein one can execute malicious scripts into a page.

Why does this vulnerability exist?

Cross-site scripting exists whenever input can be interpreted as code. In this case you simply replace {{message}} in template.html with the user's message without escaping the input:

var renderDel = function(message) {
    return template.replace(/{{message}}/g, message);
}

Link: https://github.com/KingPixil/lock/blob/master/src/view.js#L6-L8

<div id="content">
    <h3 class="centered">{{message}}</h3>
    <h5 id="counter">5</h5>
</div>

Link: https://github.com/KingPixil/lock/blob/master/views/template/template.html#L22-L25

With the payload this looks as follows:

<div id="content">
    <h3 class="centered"><svg onload=alert(1)></h3>
    <h5 id="counter">5</h5>
</div>

The example above should open up an alert box displaying 1.

What are the exploits?

A cross-site scripting vulnerability allows an attacker to modify the page.

A very good list of malicious payloads can be found here: http://www.xss-payloads.com/payloads.html

How can this be prevented?

As mentioned before, all user input should be escaped.

Please do add a link to this repository on the webpage. Maybe an icon will do fine