Fixes potential XSS at any page containing grid.

Review Request #3658 — Created Dec. 12, 2012 and submitted

Information

Djblets

Reviewers

Every site, containing datagrids, can be hacked,
using simple XSS, leading to cookies leak.

To reproduce the problem, go to any site, wich uses
djblets.datagrid. For example, open http://demo.reviewboard.org/r/

Now add ?111'%3balert(document.cookie)//222=1 to the end of the URL and load that
page. That is the way, how a cookie thief will prepare the URL for
his victim.

Then click to any table's header and you'll see an alert box with all
your cookies.

 
david
  1. Ship It!
  2. 
      
SV
Review request changed

Status: Closed (submitted)

Change Summary:

Pushed to master (b19d7e0). Thanks!
Loading...