Stored Cross Site Scripting vulnerability exists in post content. about anchor-cms HOT 4 CLOSED

Duplicate of #1298

from anchor-cms.

Any relevant commit for the above issue?

from anchor-cms.

@galaktipus There's no commit because it was deemed to not be an issue. In the thread it was discussed that AnchorCMS has this as a feature, and not as a vulnerability.

Further, in the contribution guidelines, we request that you search for your issue to see if it's already been reported before opening a new one. This has obviously not been done. :(

from anchor-cms.

Apologies, this was my mistake, I did not realize it was a dupe until I had posted the issue. I do recommend blocking event handlers and script tags, to provide some sort of security, but still allowing HTML customizable content. Maybe add toggleable HTML entity encoding. Without this option, the XSS can be exploited for horizontal privilege escalation.

I understand this was added as a feature, but it can still be used maliciously to some extent, and it is worth thinking about how the end user interacts with your product. Of course it is completely your choice on how you move forward with this.

Thank you for your time, and sorry again for the duplicate issue :)

from anchor-cms.