Skip to content

Check security of jeckyll jsonify #25

@SteveALee

Description

@SteveALee

XSS attacks are potentially possible given some data in text fields is user entered so untrusted..

eg with text </script><script>alert('mwahaha!!')</script>

As a minimum should escape all the unsanitised input text in the liquid templates, eg in HTML using escape or escape_once:

Could also sanitise the input before adding to the JSON file

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions