HomePhabricator

Transactions T118682 Change Details

Change Details

Old
New
Diff

Parameters descriptions allow raw HTML: lang=json { "params": { "1": { "description": "<a onclick=\"alert('XSS')\">Test</a>" } } } The link is directly inserted, clicking on it executes the Javascript script.

Parameters descriptions allow raw HTML: lang=json { "params": { "1": { "description": "<a onclick=\"alert('XSS')\">Test</a>" } } } The link is directly inserted, clicking on it executes the Javascript script.

Parameters descriptions allow raw HTML: lang=json { "params": { "1": { "description": "<a onclick=\"alert('XSS')\">Test</a>" } } } The link is directly inserted, clicking on it executes the Javascript script.

Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL