dotless/dotless — Issue #142: Unsafe channeling of parameters through less url
Author: agatronic
Created: 2012-02-29 17:34:20+00:00
State: open

As pointed out in Issue #135, a user can do a XSS attack via for instance

http://localhost/mysite/css/default.less?myVariable=%65%78%70%72%65%73%73%69%6F%6E%28%61%6C%65%72%74%28%27%58%53%53%27%29%29

They could also exploit a bug in dotless to make the web server crash (e.g. call a mixin with the same name).

Should we restrict \n{}(); characters and is that sufficient to fix the problem?