crnelson/drsharelove — Issue #1: Script Injection/JS scripts not escaped
Author: tacitus23b
Created: 2011-11-22 00:38:26+00:00
State: open

Sharelove does not check "content" for javascript code block before posting to the feed. Javascript posted as part of "content" will run when displayed to user.

Steps To Reproduce

HTTP POST to http://drsharelove.cnelson.org/content/share

with following name/value pairs

id	foo@example.com
url	http://example.com/js
title	Is Javascript Escaped?
content
note	Test To see if javascript is escaped
author	Java Script

id=foo%40example.com&url=http%3A%2F%2Fexample.com%2Fjs&title=Is+Javascript+Escaped%3F&content=%3Cscript+language%3D%22javascript%22%3Ealert%28%27test%27%29%3B%3C%2Fscript%3E¬e=Test+To+see+if+javascript+is+escaped&author=Java+Script

Other free-form fields (title, note, author) not tested but might contain same issue