Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Security] [URGENT] XSS injection error page #381

Closed
S0c5 opened this issue Jan 29, 2018 · 2 comments
Closed

[Security] [URGENT] XSS injection error page #381

S0c5 opened this issue Jan 29, 2018 · 2 comments
Assignees
@joshcanhelp
Milestone
3.5.2

Comments

@S0c5
Copy link

S0c5 commented Jan 29, 2018

XSS injection

There is a security issue with the error handler page that allows to attackers Inject malicious code.

replication

  http:https://localhost/index.php?auth0=1&error=invalid_request&error_description=<h1>bug</h1>
joshcanhelp added a commit that referenced this issue Jan 29, 2018
@joshcanhelp
Fixing XSS vulnerability in error_description; fixes #381
e77b2fd
@joshcanhelp
Copy link
Contributor

Thanks for the report, @S0c5, just pushed a fix for review.

@joshcanhelp joshcanhelp mentioned this issue Jan 29, 2018
Merged
joshcanhelp added a commit that referenced this issue Jan 29, 2018
@joshcanhelp
Fixing XSS vulnerability in error_description; fixes #381
b197db6
@joshcanhelp
Copy link
Contributor

#383 approved and merged, ready for next release 👍

@joshcanhelp joshcanhelp added this to the v3-Next milestone Jan 29, 2018
@joshcanhelp joshcanhelp self-assigned this Jan 29, 2018
@S0c5 S0c5 mentioned this issue Jan 30, 2018
Closed
@cocojoe cocojoe closed this as completed Jan 30, 2018
joshcanhelp added a commit that referenced this issue Feb 28, 2018
@joshcanhelp
Fixing XSS vulnerability in error_description; fixes #381
ba34694
@github-actions github-actions bot locked as resolved and limited conversation to collaborators Sep 19, 2022
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees

@joshcanhelp joshcanhelp

Labels
None yet
Projects
None yet
Milestone
3.5.2
Development

No branches or pull requests
3 participants
@joshcanhelp @cocojoe @S0c5