- priority: 5 --> 9
I have test magpierss, i find the issue xss when
magpierss show the data in the someone rss or atom file.
More exactly in the "title" item, if rss or atom file
content:
case 1:
<title><![CDATA[[ <script
language="javascript">alert('XSS');</script> ]]></title>
result:
show alert
case2:
<title><![CDATA[ <script
language="javascript">alert("XSS");</script>
]]></title>
result:
don't show nothing
case3:
<title> <script
language="javascript">alert("XSS");</script>
</title>
result:
show alert
case4:
<title> <script
language="javascript">alert('XSS');</script> </title>
result:
nothing, magpierss don't take this sintaxis =)
magpierss show the code not escaped, or using
htmlentities() for title text.
I don't know if magpierss will be escaped this code, or
only the application that use magpierss.
may be this issue repeat in the other's places the xml
structure, author, link, uid, etc., etc..
sorry my english is bad =P.
greetings.