polyfony-inc/polyfony

Reflected XSS in the default Exception view

Closed this issue · 1 comments

AnnoyingTechnology commented

A specially crafted URL can offer successful XSS exploitation.

AnnoyingTechnology commented

A good belt+suspenders approach is having a ->where('preg_match'=>'a-zA-Z0-9') on all routes parameters in addition to this fix.