Exploits in Dojo Toolkit

[disturbed_1]

It many of the Dojo tookit's forms and basically anything where a user can submit text...

for example ​http://demos.dojotoolkit.org/demos/babelChat/

if you enter simple javascript it will run...

<script>alert('Vuln');</script>

This also means that it not only affects the sites look [By defacement] but also can endanger users [XSS Cookie Stealing]

This is just a heads up to make sure your scripts check characters/modify [Or at least have an option to do so] or else this will discourage users to not use your code....

If you want any more information feel free to contact me...

[dante]

So to be clear, you didn't find anything like this in dojotoolkit.org/ directly ... (drupal should be covering most of the inputs there) but I agree, babelChat should totally be escaping input too. Will fix that, but I'd love to hear if you know of any other places.

we have a ticket for adding core html-escaping functionality to Dojo, which will be used to sanitize stuff incoming like this.

Thanks for the headsup.

[dante]

these are on the site now, so I'll be upping the demos/ to 1.3.1 asap. backporting the fixes so they make it.

[dante]

(In [17333]) fixes all known occurences of xss vulnerabilities in the demos. please report if more found. fixes #9006

[dante]

(In [17334]) refs #9006 - putting the survey fix into trunk too