Bug #23

Description fields are vulnerable to XSS

Status:	Closed
Priority:	Critical
Added by:	scot on April 30, '24
Assigned to:	Unassigned
Due date:
Reported for:	0.6.0

Steps to Reproduce

1. Create an issue or project
2. In the description field, insert the XSS of your choice
3. Insert any other content into the description field
4. See your inserted JS affect the page

Explanation

XSS In description boxes. This applies to both project descriptions and issue descriptions. I've been poking around a bit, and it seems like any field that supports markdown is vulnerable. Thankfully, other fields seem unaffected.

It doesn't seem like there's any sanitization at all.

This is a link to one of the issues I opened in a test project. A few XSS tests in that project, nothing malicious though:
https://app.betahub.io/projects/190/issues/4 (this one's stupid but fun)

Also, check your console ;)
<script>console.log("Hello There :)")</script>

Watchers

Watch