mirrors
/
forgejo
mirror of
1
Fork 0
Code Issues Releases Activity
forgejo/tests/integration/fixtures/TestXSSReviewDismissed/comment.yml

10 lines
180 B
YAML
Raw Normal View History

[SECURITY] Test XSS in dismissed review It's possible for reviews to not be assiocated with users, when they were migrated from another forge instance. In the migration code, there's no sanitization check for author names, so they could contain HTML tags and thus needs to be properely escaped. (cherry picked from commit ca798e4cc2a8c6e3d1f2cfed01f47d8b3da9361f)
2024-01-18 00:18:39 +01:00
-
id: 1000
type: 32 # dismiss review
poster_id: 2
issue_id: 2 # in repo_id 1
content: "XSS time!"
review_id: 1000
created_unix: 1700000000
updated_unix: 1700000000