Home → Problems →

html not sanitized in issue titles, allowing XSS

• Edit

Jed Schmidt

24 Apr, 2009 06:17 AM

Here's an example:

https://github.com/jed/langwidget.com/issues/#issue/10

The title is <script>alert('html needs to be sanitized')</script>, which is actually executed.

1. 1 Posted by Kyle Neath (Git... on 24 Apr, 2009 05:14 PM

   

   Hey Jed,

   I think you might have support systems mixed up. This is Tender, the software that powers Github's support site. Try submitting your issue at http://support.github.com

   Thanks!

   • Edit

2. Kyle Neath (GitHub Staff) closed this discussion on 24 Apr, 2009 05:14 PM.

3. Jed Schmidt re-opened this discussion on 24 Apr, 2009 05:18 PM

4. 2 Posted by Jed Schmidt on 24 Apr, 2009 05:18 PM

   

   Oops, my bad. Sorry for the distraction!

   • Edit