Skip to content

fixed possible xss in example - #4028

Closed
rubiin wants to merge 4 commits into
expressjs:masterfrom
rubiin:example/params-map-update
Closed

fixed possible xss in example#4028
rubiin wants to merge 4 commits into
expressjs:masterfrom
rubiin:example/params-map-update

Conversation

@rubiin

@rubiin rubiin commented Aug 19, 2019

Copy link
Copy Markdown 
GET /users/%22%3E%3Csvg%20onload=prompt()%3E HTTP/1.1
Host: 192.168.122.246:3000
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1

dougwilson
dougwilson suggested changes Aug 19, 2019
View reviewed changes

@dougwilson dougwilson left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you. Can you update the PR from what was discussed here? #3992 (comment)

@dougwilson dougwilson changed the title fixed possible xss in the params fixed possible xss in example Aug 19, 2019
@rubiin

rubiin commented Aug 19, 2019

Copy link
Copy Markdown
Author

Sure. I will leave a comment there right away

@rubiin

rubiin commented Aug 19, 2019

Copy link
Copy Markdown
Author

Updated the file with necessary comment. Please check

mendoanjoe
mendoanjoe reviewed Aug 19, 2019
View reviewed changes
Comment thread examples/route-map/index.js
Rubin Bhandari and others added 2 commits August 19, 2019 16:42
Rubin Bhandari @mendoanjoe
Update examples/route-map/index.js
af27ec9 
Co-Authored-By: Firmansyah Nuralif Rohman <mendoanjoe@gmail.com>
@rubiin
Update index.js
532acb3
@rubiin
rubiin requested a review from dougwilson January 5, 2020 14:59
@dougwilson

dougwilson commented Mar 25, 2020

Copy link
Copy Markdown
Contributor

I'm going to mark this as a duplicate of #4119 since they fix the same example, except #4119 uses the proper type of escaping.

@dougwilson dougwilson closed this Mar 25, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@dougwilson dougwilson Awaiting requested review from dougwilson
1 more reviewer
@mendoanjoe mendoanjoe mendoanjoe left review comments
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

duplicate examples pr

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@rubiin @dougwilson @mendoanjoe