[XSS BUG] The `<strong>` tag in the block data destroyed the template html structure

in #utopian-io • 8 years ago (edited)

Expected behavior

This is the normal page.
normal.gif

Actual behavior

This is the error block I found. ( Block #19734336 )
error.gif

How to reproduce

Open the block #19734336 and you 'll find the html structure has been destroyed.
The reason is that the <strong> tag in the block data destroyed the html structure.

bug.png

This is a potential xss security vulnerability.

I have test it in here. https://steemdb.com/block/19772482.


Posted on Utopian.io - Rewarding Open Source Contributors

#steemdev #steemdb #steem
8 years ago in #utopian-io by
$22.50
  • Past Payouts $22.50
  • - Author $15.90
  • - Curators $6.59
26 votes
Reply 4
Sort:  
  • Trending
    • [-]
     8 years ago (edited)

    Thank you for the contribution. It has been approved.

    This indeed is a big issue.

    You can contact us on Discord.
    [utopian-moderator]

    $1.72
    • Past Payouts $1.72
    • - Author $1.49
    • - Curators $0.24
    3 votes
    Reply
    [-]
     8 years ago 

    Hey @justyy, I just gave you a tip for your hard work on moderation. Upvote this comment to support the utopian moderators and increase your future rewards!

    $0.00
      Reply
      [-]
       8 years ago 

      I will follow you! I give you a Upvote!

      $0.00
        Reply
        [-]
         8 years ago 

        Hey @ety001 I am @utopian-io. I have just upvoted you!

        Achievements

        • You have less than 500 followers. Just gave you a gift to help you succeed!
        • Seems like you contribute quite often. AMAZING!

        Suggestions

        • Contribute more often to get higher and higher rewards. I wish to see you often!
        • Work on your followers to increase the votes/rewards. I follow what humans do and my vote is mainly based on that. Good luck!

        Get Noticed!

        • Did you know project owners can manually vote with their own voting power or by voting power delegated to their projects? Ask the project owner to review your contributions!

        Community-Driven Witness!

        I am the first and only Steem Community-Driven Witness. Participate on Discord. Lets GROW TOGETHER!

        mooncryption-utopian-witness-gif

        Up-vote this comment to grow my power and help Open Source contributions like this one. Want to chat? Join me on Discord https://discord.gg/Pc8HG9x

        $0.00
          Reply

          Coin Marketplace

          STEEM 0.04
          TRX 0.33
          JST 0.104
          BTC 64428.11
          ETH 1880.16
          USDT 1.00
          SBD 0.37