artesaos/seotools

XSS Responsibility?

Opened this issue · 0 comments

iBotPeaches commented

What steps will reproduce the problem?

  1. Insert an XSS into SEOTools::setTitle(); or SEOTools::setDescription();
  2. View Site
<script type="application/ld+json">{"@context":"https://schema.org","@type":"WebPage","name":"<script>alert(0)</script> on Bazaar","description":"<script>alert(0)</script> on Bazaar in Custom at Aug 1, 2024 with: xxx","image":"https://blobs-infiniteugc.svc.halowaypoint.com/ugcstorage/map/298d5036-cd43-47b3-a4bd-31e127566593/5546a6ec-841d-4955-be7a-5f32c3ac0428/images/thumbnail.png"}</script>

What is the expected result?

  1. Nothing happens, but encoded text.

What do you get instead?

  1. An XSS

Additional info

Q A
This Package Version 1.3.1
Laravel Framework Version 11.x

Should the package be cleansing data prior to writing to tags? Or is it up to me to cleanse data prior to injecting into library?