1

I am working on a Drupal 7 site that uses a replacement pattern %1 inside a View header to generate a URL with the Organic Group id(og_group_ref).

The view header markup is

<a class="ct" href="/node/add/post?og_group_ref=%1">Create Convo</a>

Example URL of a page is site/b_posts/2, so the link created would be /node/add/post?og_group_ref=2.

This is vulnerable to XSS, since accessing the URL site/b_posts/%22%20onmouseover=%22alert%28559%29%22%20test=%22/2 would result in a JS alert getting executed on mousing over the link. How to protect against this? I used the latest version of Views and this is still happening.

  • 1
    Welsome to Drupal Answers. How do you create this link exactly? – berliner Mar 6 '14 at 23:12
1

You must enable validation on your contextual filter.

More information found here:

https://drupal.org/node/1578564

http://nodeone.se/en/learn-views-with-nodeone-part-23-validation-of-contextual-filter-input

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.