This repository has been archived by the owner on Dec 10, 2020. It is now read-only.
-
Notifications
You must be signed in to change notification settings - Fork 313
XSS issue? #181
Comments
We fixed similar issues a while back and I thought either this one was fixed or there was some reason it wasn't an issue, but nevertheless we're killing the poster since we only rely on the HTML poster. Should have a patch out soon. #183 |
Fixed in 4.12.15, back ported to 4.12 versions on the CDN. Thanks! |
zhangbobell
added a commit
to fex-team/ueditor
that referenced
this issue
Feb 25, 2016
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
We had a bug reported that seems to exploit the src attribute of the video.js swf file to run js code. I'm not entirely sure how it works:
video-js.swf?src=blob:vjs-media-source/123%5C"))%7Dcatch(e)%7Balert(document.domain)%7D//&debug=true
Is this a known issue? How do we prevent this happening?
The text was updated successfully, but these errors were encountered: