Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Ladybird Task Manager doesn't html escape process.title #24293

Closed
xBZZZZ opened this issue May 12, 2024 · 3 comments · Fixed by #24298
Closed

Ladybird Task Manager doesn't html escape process.title #24293

xBZZZZ opened this issue May 12, 2024 · 3 comments · Fixed by #24298
Labels

Comments

@xBZZZZ
Copy link

xBZZZZ commented May 12, 2024

builder.appendff(" - {}", *process.title);

screenshot
unrelated question
why use

builder.append("<tr>"sv);
builder.append("<td>"sv);

instead of
        builder.append("<tr><td>"sv);
?

@Hendiadyoin1
Copy link
Contributor

Pretty sure this is technically an XSS vulnerability on our part
who stops you from using <script> here
(Although not sure what info one could get form the task manager process)

@xBZZZZ
Copy link
Author

xBZZZZ commented May 12, 2024

who stops you from using <script>

nothing, scripts also work (alert("hello") freezes task manager but no dialog)

@Hendiadyoin1
Copy link
Contributor

Tested the same in this thread over on discord -> https://discord.com/channels/830522505605283862/830525031720943627/1239251878810751076

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants