{"action":"closed","issue":{"url":"https://api.github.com/repos/Automattic/socket.io/issues/1927","labels_url":"https://api.github.com/repos/Automattic/socket.io/issues/1927/labels{/name}","comments_url":"https://api.github.com/repos/Automattic/socket.io/issues/1927/comments","events_url":"https://api.github.com/repos/Automattic/socket.io/issues/1927/events","html_url":"https://github.com/Automattic/socket.io/issues/1927","id":52959865,"number":1927,"title":"Critical - Script injection on Chat demo","user":{"login":"cauli","id":284283,"avatar_url":"https://avatars.githubusercontent.com/u/284283?v=3","gravatar_id":"","url":"https://api.github.com/users/cauli","html_url":"https://github.com/cauli","followers_url":"https://api.github.com/users/cauli/followers","following_url":"https://api.github.com/users/cauli/following{/other_user}","gists_url":"https://api.github.com/users/cauli/gists{/gist_id}","starred_url":"https://api.github.com/users/cauli/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cauli/subscriptions","organizations_url":"https://api.github.com/users/cauli/orgs","repos_url":"https://api.github.com/users/cauli/repos","events_url":"https://api.github.com/users/cauli/events{/privacy}","received_events_url":"https://api.github.com/users/cauli/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2014-12-27T15:53:15Z","updated_at":"2015-01-10T00:37:59Z","closed_at":"2015-01-10T00:37:59Z","body":"I was poking around the chat demo and found out security breach.\r\nI could inject ```<script>``` tags on every users browsers, and had some sadistic smirk on my face creating alerts for all people.\r\n\r\nThe thing is: the messages are treated for HTML tags only on the client side, and should also be treated on the server side.\r\n\r\nAlso, it uses the fact that messages are treated, but usernames are not.\r\n\r\nHow I did it:\r\n\r\nOn Chrome inspector:\r\n\r\n```javascript\r\nvar socket = io('chat.socket.io');\r\nsocket.emit('add user', '<script>alert(\"Breach : (\")</script>');\r\n```\r\n\r\nBut I can imagine it can be used to far worse stuff, like force-visiting other websites, stealing information and such. "}}