Skip to content
This repository has been archived by the owner on Jul 24, 2021. It is now read-only.

should user language settings be sanitized? #2892

Closed
openstreetmap-trac opened this issue Jul 23, 2021 · 1 comment
Closed

should user language settings be sanitized? #2892

openstreetmap-trac opened this issue Jul 23, 2021 · 1 comment

Comments

@openstreetmap-trac
Copy link

Reporter: amm
[Submitted to the original trac issue database at 9.25am, Sunday, 18th April 2010]

As a followup on #2891, it is possible to inject javascript into the site, by adding the javascript to your languange settings and calling the search function on the mainsite. The error message there will contain the language settings verbatim and thus execute the script.

I don't think it is a security problem, as you can only shoot your self in the foot with it rather than harm others, but it might never the less be nice to prevent this. Altogether warning the user if they entered a broken string in the language setting might be a good thing.

@openstreetmap-trac
Copy link
Author

Author: tomhughes
[Added to the original trac issue at 11.41am, Sunday, 18th April 2010]

(In [20920]) Escape geocoder errors. Closes #2892.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Projects
None yet
Development

No branches or pull requests

1 participant