Show HN: I made a free, ad-free and open source tool for sharing private notes

Re:Show HN: I made a free, ad-free and open source tool for ... by 28uwedj on Wednesday December 01, 2021 @12:50AM (#29401100)

DO NOT USE THIS SITE:

1. Create Note with the contents <script>alert(1);</script>

2. Go to link

3. this site is a massive security flaw.

[ Parent | on HN ]

Re:Show HN: I made a free, ad-free and open source tool for ... by gigamick on Wednesday December 01, 2021 @03:28AM (#29401899)

This is exactly why I posted here. Thank you so much for this feedback. Will fix and let you know.

[ Parent | on HN ]

Re:Show HN: I made a free, ad-free and open source tool for ... by teitoklien on Wednesday December 01, 2021 @09:17AM (#29403774)

Your laravel php framework debug messages are being exposed to users.

Cool site tho, Have a lovely week.

[ Parent | on HN ]

Re:Show HN: I made a free, ad-free and open source tool for ... by gigamick on Thursday December 02, 2021 @07:10AM (#29415145)

This issue now resolved.

[ Parent | on HN ]

Re:Show HN: I made a free, ad-free and open source tool for ... by svenfaw on Wednesday December 01, 2021 @03:54AM (#29402021)

To clarify, why is being able to display an alert a massive security flaw in this context?

[ Parent | on HN ]

Re:Show HN: I made a free, ad-free and open source tool for ... by retube on Wednesday December 01, 2021 @04:08AM (#29402082)

The alert itself is harmless, but demonstrates that arbitrary javascript - which could certainly not be harmless - can be injected into the page.

[ Parent | on HN ]

Re:Show HN: I made a free, ad-free and open source tool for ... by mynameismon on Wednesday December 01, 2021 @04:10AM (#29402093)

It's not the ability to display alerts that is concerning, but rather, the ability to run untrusted Javascript. This was a proof of concept that showed that it has a serious XSS vulnerability

[ Parent | on HN ]

Re:Show HN: I made a free, ad-free and open source tool for ... by seedie on Wednesday December 01, 2021 @05:25AM (#29402450)

For detailed information on what XSS is, how it can be exploited and prevented have a look at the OWASP XSS description

https://owasp.org/www-community/attacks/xss

[ Parent | on HN ]

Re:Show HN: I made a free, ad-free and open source tool for ... by gigamick on Wednesday December 01, 2021 @07:24AM (#29403019)

This is now resolved. Thanks for the feedback!

[ Parent | on HN ]

Re:Show HN: I made a free, ad-free and open source tool for ... by gigamick on Thursday December 02, 2021 @07:20AM (#29415202)

ISSUE RESOLVED

[ Parent | on HN ]