News for hackers. Stuff that matters.

A comment on Show HN: I made a free, ad-free and open source tool for sharing private notes. Parent comment

Re:Show HN: I made a free, ad-free and open source tool for ... by svenfaw on Wednesday December 01, 2021 @03:54AM (#29402021)
To clarify, why is being able to display an alert a massive security flaw in this context?
[ Parent | on HN ]
Re:Show HN: I made a free, ad-free and open source tool for ... by retube on Wednesday December 01, 2021 @04:08AM (#29402082)
The alert itself is harmless, but demonstrates that arbitrary javascript - which could certainly not be harmless - can be injected into the page.
[ Parent | on HN ]
Re:Show HN: I made a free, ad-free and open source tool for ... by mynameismon on Wednesday December 01, 2021 @04:10AM (#29402093)
It's not the ability to display alerts that is concerning, but rather, the ability to run untrusted Javascript. This was a proof of concept that showed that it has a serious XSS vulnerability
[ Parent | on HN ]
Re:Show HN: I made a free, ad-free and open source tool for ... by seedie on Wednesday December 01, 2021 @05:25AM (#29402450)
For detailed information on what XSS is, how it can be exploited and prevented have a look at the OWASP XSS description

https://owasp.org/www-community/attacks/xss

[ Parent | on HN ]