ProjectSegfault/invidious-experimenting
4
0
Fork 0
forked from midou/invidious
Code Pull Requests Activity

Fix XSS vulnerability in channel playlists

Browse Source 
The channel/<ucid>/playlists page was vulnerable to Cross Site Scripting
(XSS), because the different URL parameters were inserted as-is in the URL
meant for instance switching.

This vulnerability could allow an attacker to inject malicious Javascript
in the page by tricking the user to click on a crafted link.

Bug introduced in commit 66e7285108363c3c3dcb814bdffb716c14e1724d
("Only use /redirect when automatically redirecting").

Thanks to Jack (@testa:cthd.icu on Matrix, @cysea on github) for responsibly
reporting this issue!
This commit is contained in:
Samantaz Fox 2021-12-19 20:11:50 +01:00
parent 2ac19eb8fc
commit ddb06b0cac
No known key found for this signature in database
GPG Key ID: F42821059186176E
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/invidious/views/playlist.ecr
View File

@ -47,7 +47,7 @@
<%= translate(locale, "Switch Invidious Instance") %> <%= translate(locale, "Switch Invidious Instance") %>
</a> </a>
<% else %> <% else %>
<a href="https://redirect.invidious.io<%= env.request.resource %>"> <a href="https://redirect.invidious.io/playlist?list=<%= playlist.id %>">
<%= translate(locale, "Switch Invidious Instance") %> <%= translate(locale, "Switch Invidious Instance") %>
</a> </a>
<% end %> <% end %>