Supporto The Movie Database
Supporto → Supporto API
SECURITY ISSUE!
pubblicato da Joe RoseSTAFFMOD il 8 giugno, 2015 alle 9:29PM
Travis;
This just tripped a SECURITY ALERT in my app during a movie scrape!
Record: 313022 Trailer Path: Path: http://www.youtube.com/watch?v=
Html code in a database record??? Not good.
Please comment.
Joe
Risposta da Joe Rose
il 8 giugno, 2015 alle 9:32PM
Travis;
Sure enough! It executed in this post!
Risposta da Travis Bell
il 8 giugno, 2015 alle 11:29PM
Hi Joe,
I don't believe there's any sanitization on the video field. I've created a new ticket for this here. It's very much related to ticket #887, so I'll do them both at the same time.
Risposta da LordMike
il 15 giugno, 2015 alle 5:04PM
Uh .. just for the record. It is perfectly fine to have HTML or any other form of "code" or "markup" in the database. In fact - it should stay in that format.
It is YOUR job as a consumer to sanitize/encode values when presenting them, because only YOU know which format they should go in. (As an example, for HTML, there are different encodings depending on if you want some text in the body, attributes, javascript or css).
Mike