demos contain cross site scripting about brookframework HOT 5 CLOSED

All the online demos are very simple, but you can update it for strip all HTML/XML scripts. The online chat demo (http://brookframework.org/demos/others/chat/cgi1.fbf) don't allow HTML/XML scripts, please test it.

Can you open a pull request with updated demos? We would be very grateful! :)

ps. In chat demo I used the RUtils.StripHTMLMarkup (https://github.com/silvioprog/rutils/blob/master/src/rutils.pas#L106).

from brookframework.

I'll require some time to learn the code, and I'll for the project and add it :)
I think it's very important to educate people to work properly, and secure, even when things are considered to be simple.

from brookframework.

I fully agree. :)

Please feel free to implement it.

from brookframework.

Fixed (47e1455).

Please test it and close if OK. ;)

Thank you! :)

ps. I'll update online demos as soon.

from brookframework.

Obrigado,

You do not have to strip HTML elements, just escape them :)
I looked at the source code, and it looks ok.

from brookframework.