Timeline for Node field not sanitize on render
Current License: CC BY-SA 4.0
7 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jul 1, 2019 at 9:35 | comment | added | Romain |
Ok, It's because of a breadcrumb block who render my field_title. with a |raw . Not a good idea.. Thank you for your help !
|
|
| Jul 1, 2019 at 9:29 | comment | added | 4uk4 | Please add the information as asked to reproduce this behavior. | |
| Jul 1, 2019 at 9:11 | comment | added | Romain |
The value of the field is : <script>alert('XSS problem')</script>. The script is exexcuted and if i click on 'OK' to close the alert windows, i can see the script written on the page.
|
|
| Jun 29, 2019 at 15:34 | comment | added | 4uk4 | In case it is executed then post the entire code what you put into the variable and what else the template contains which might be relevant for autoescaping. | |
| Jun 29, 2019 at 13:46 | answer | added | Ismail Cherri | timeline score: 0 | |
| Jun 28, 2019 at 16:15 | comment | added | 4uk4 | Do you see the script tag on the screen? Then it is auto escaped and can't be executed. | |
| Jun 28, 2019 at 15:06 | history | asked | Romain | CC BY-SA 4.0 |