Code injection security issues about django-jchat HOT 5 CLOSED

Thank you for raising this issue.

I have thought of fixing it by replacing < and > characters with < and > 
characters right before saving the sent message into the database, so that the 
string 
is safe no matter how/when/where it is rendered.

What do you think, is it elegant enough?

Out of concerns of completeness I would not use such a solution. I'm assuming 
you
mean replacing < and > with < and > on the server side (as in doing it client
side would be a new security issue). 
Instead I would do it by not displaying user-contributed HTML what so ever on 
the
client side (the templating system already does this by default) and instead 
swap in
the smileys and stuff on the client side by searching through every new message 
and
replacing it by the smiley image.. this should be fairly easy to do with JQuery.

Your application can't know for certain the data it gets from the DB is in fact
valid, "safe" content, since it's conceivable someone would be able to break 
into the
DB without breaking into the app and then contaminate the content in the DB, 
thereby
making users vulnerable to XSS attacks if the apps don't escape such data before
displaying it.

I see your point, I totally forgot about hacks like the one you mentioned, 
where the 
database is directly affected.

I'll be fixing this on the client side asap.

Thanks for the suggestion.

This issue was closed by revision r4.

Fixed on r4, thanks for the heads up!