XSS vulnerability when publish html report (OD-230)

Robin Shen opened 5 years ago

A user with permission to push code to repository may edit build spec to publish html report containing malicious javascript code or links, and other users accessing that report will be subject to XSS attack.

To solve the issue, the html report publish ability will be removed.

OneDev changed state to 'Closed' 5 years ago
Previous Value Current Value
Open

Closed
OneDev changed state to 'Released' 5 years ago
Previous Value Current Value
Closed

Released
Login to comment

Previous Value	Current Value
Open	Closed

Previous Value	Current Value
Closed	Released

Type	Bug
Priority	Critical
Assignee	Robin Shen
Affected Versions	Not Found

Issue Votes (0)

Watchers (2)

Reference

OD-230