Very vulnerable to a XSS about discord-embed-sandbox HOT 5 OPEN

If you have a serious security vulnerability to report, I am reachable on discord in https://discord.gg/red as Flame#2941. This post does not have enough information for me to understand what is going on, so I urge you to send me a private message if you have a legitimate vulnerability to report.

from discord-embed-sandbox.

If you have a serious security vulnerability to report, I am reachable on discord in https://discord.gg/red as Flame#2941. This post does not have enough information for me to understand what is going on, so I urge you to send me a private message if you have a legitimate vulnerability to report.

For example in the inputs an XSS can be executed

from discord-embed-sandbox.

Yeah but this does not go to any server or even get displayed to anyone else besides you when do that and you can use alert in dev tools so?

from discord-embed-sandbox.

I wouldn't call this a serious or exploitable vulnerability, however, a script injection attack is possible if a user pastes a malicious string into one of the fields. Of course, this would be as good as useless as AFAIK the site doesn't store anything valuable other than the values of the other fields, so there's nothing for an attacker to take.

This is still an issue as entering certain values (eg if you want <something> to appear in one of your fields) will make them not show up as they are seen as HTML. (see screenshot)

The issue is that there is no input sanitisation performed in the updateEmbed function, for example here:

If the input is first properly sanitised, for example with something like this, or ideally a proper sanitisation library, the issue would be resolved.

from discord-embed-sandbox.

Considering, afaik, you cannot add URL-parameters for an embed (ie ?title=test&description=<script>alert('hi')</script>&fields=[title=a;value=b;inline=1]), this doesn't seem like a Cross-Site-Scripting Vulnerability, rather a trivial bug.
However, I would still like to see sanitation, so forks of the project which may allow that aren't unknowingly vulnerable to this.
Will likely open a PR that fixes this in a bit.

EDIT: opened a PR that fixes this; see #25

from discord-embed-sandbox.