Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

HTML realname becomes long join message #1196

Open
Mikaela opened this issue Jul 10, 2021 · 2 comments
Open

HTML realname becomes long join message #1196

Mikaela opened this issue Jul 10, 2021 · 2 comments
Labels
bug

Comments

@Mikaela
Copy link

Mikaela commented Jul 10, 2021

image

The real name string here is "><svg/onload=confirm(/xss/)>
@lorenzhs lorenzhs added the bug label Jul 11, 2021
@lorenzhs
Copy link
Member

Can you share the HTML that is generated for that message? Sounds like something is going wrong here with regards to input sanitizing.

@Mikaela
Copy link
Author

Mikaela commented Jul 12, 2021

How can I get it? I cannot see it in inspect element or page source.

The only html I see is the realname in my original message, so I guess this should be reproducable by setting it as real name and joining a channel where Glowing Bear with WeeChat having extended-join enabled can see it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@lorenzhs @Mikaela