[SECURITY] XSS possible in readme about gitly HOT 10 CLOSED

Right now, markdown isn't rendered at all. I think md files are just dumped as text to the browser. So no vulnerability there.

Definitely something to keep in mind once markdown rendering is live.

from gitly.

I stand corrected. This is indeed something that should be fixed ASAP.

from gitly.

FYI since pushing to gitly is not available yet, the source is also viewable seperately (without XSS :^) here

from gitly.

Thanks for reporting this!

from gitly.

A xss vuln is usually considered critical...
You could steal sessions and a lot of other really bad stuff could happen and you don't care?

from gitly.

I never said anything about not caring. Dumping text to the browser windows is NOT an xss vulnerability, since it is just text, and doesn't get executed.

If you know for a fact that it is being executed, then yes, that is indeed a critical problem.

from gitly.

Well if you click on the link you should see an alert. That's a pretty good sign that there is some execution going on.

from gitly.

This is not a gitly problem this is a vweb problem because the text inserts wrong. It needs to be filtered

from gitly.

well we use vweb.RawHtml to render readme.md

I've disabled it entirely, until we use an actual markdown parser again.

from gitly.

I've wrote a fix now for it in vweb with the new type vweb.RawText

from gitly.