Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Linkify not sanitizing output HTML #10089

Closed
0xdeadbeer opened this issue Aug 22, 2022 · 0 comments
Closed

Linkify not sanitizing output HTML #10089

0xdeadbeer opened this issue Aug 22, 2022 · 0 comments
Assignees
@jeremystretch
Labels
status: accepted This issue has been accepted for implementation type: bug A confirmed report of unexpected behavior in the application

Comments

@0xdeadbeer
Copy link
Contributor

NetBox version

v3.3.1-dev

Python version

3.8

Steps to Reproduce

  1. Create a device record
  2. Create a service record
  3. Attach the service to the device
  4. Rename the service with <script>alert(1)</script> (example)
    image
  5. View the device
    image

Code where linkify is used

image

Expected Behavior

Linkify sanitizing the HTML output

Observed Behavior

Linkify not sanitizing the HTML output, allowing users to inject HTML/JS code into the website.
@0xdeadbeer 0xdeadbeer added the type: bug A confirmed report of unexpected behavior in the application label Aug 22, 2022
@jeremystretch jeremystretch self-assigned this Aug 22, 2022
@jeremystretch jeremystretch added the status: accepted This issue has been accepted for implementation label Aug 22, 2022
@jeremystretch jeremystretch mentioned this issue Aug 25, 2022
Merged
@github-actions github-actions bot locked as resolved and limited conversation to collaborators Nov 21, 2022
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees

@jeremystretch jeremystretch

Labels
status: accepted This issue has been accepted for implementation type: bug A confirmed report of unexpected behavior in the application
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@jeremystretch @0xdeadbeer