diff options
| author | Samantaz Fox <coding@samantaz.fr> | 2021-12-19 20:11:50 +0100 |
|---|---|---|
| committer | Samantaz Fox <coding@samantaz.fr> | 2021-12-19 20:51:44 +0100 |
| commit | ddb06b0cac4c0b78e2e8e085791bce4c3a760625 (patch) | |
| tree | 65329c6b0b6cc616d511b63cfe4632a0a4ee3218 | |
| parent | 2ac19eb8fce69222a94f7bd9b6dc1e5027341111 (diff) | |
| download | invidious-ddb06b0cac4c0b78e2e8e085791bce4c3a760625.tar.gz invidious-ddb06b0cac4c0b78e2e8e085791bce4c3a760625.tar.bz2 invidious-ddb06b0cac4c0b78e2e8e085791bce4c3a760625.zip | |
Fix XSS vulnerability in channel playlists
The channel/<ucid>/playlists page was vulnerable to Cross Site Scripting
(XSS), because the different URL parameters were inserted as-is in the URL
meant for instance switching.
This vulnerability could allow an attacker to inject malicious Javascript
in the page by tricking the user to click on a crafted link.
Bug introduced in commit 66e7285108363c3c3dcb814bdffb716c14e1724d
("Only use /redirect when automatically redirecting").
Thanks to Jack (@testa:cthd.icu on Matrix, @cysea on github) for responsibly
reporting this issue!
| -rw-r--r-- | src/invidious/views/playlist.ecr | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/invidious/views/playlist.ecr b/src/invidious/views/playlist.ecr index d0518de7..136981da 100644 --- a/src/invidious/views/playlist.ecr +++ b/src/invidious/views/playlist.ecr @@ -47,7 +47,7 @@ <%= translate(locale, "Switch Invidious Instance") %> </a> <% else %> - <a href="https://redirect.invidious.io<%= env.request.resource %>"> + <a href="https://redirect.invidious.io/playlist?list=<%= playlist.id %>"> <%= translate(locale, "Switch Invidious Instance") %> </a> <% end %> |