Thanks I'll keep that in mind.  I was using the http:// here b/c the
address the wikipedia onebox returned didn't have it and I wanted the test
to pass. (Unlike the amazon onebox, that doesn't use the http:// in the
template) Hopefully changing the wikipedia onebox to use the class/id to
grab img src will give me a more complete address.


On Thu, Aug 8, 2013 at 2:17 PM, Mark IJbema <notifications@github.com>wrote:

> In templates/wikipedia.handlebars:
>
> > @@ -0,0 +1,8 @@
> > +<div class="onebox">
> > +  <a href="{{url}}">
> > +    <h1>{{name}}</h1>
> > +    <h2 class="host">wikipedia.org</h2>
> > +    <img src="http:{{image}}" />
>
> But you still need to be careful with the output, lets say someone manages
> to get an 'evil' url into wikipedia, and you retrieve the following url:
>
> http://foo.com" onmouseover="alert('boo!')
>
> when you hover the image, code gets executed in the context of your site
> (say discourse). Of course this example is innoceous, but you could use
> this technique to post in your name, or if you're admin ban users, etc.
>
> Again, I think it's quite improbable in this case, but it would be good to
> pay attention to this. I noticed that this wasn't done before (in the old
> oneboxes), and I think it would be wise to do good security from the start,
> since you're recreating the oneboxes.
>
> —
> Reply to this email directly or view it on GitHub<https://github.com/dysania/onebox/pull/33/files#r5670319>
> .
>