Υποστήριξη για το The Movie Database
Υποστήριξη → Υποστήριξη API
SECURITY ISSUE!
Δημοσιεύτηκε από τον/την Joe RoseSTAFFMOD στις 8 Ιούνιος 2015 στις 09:29 ΜΜ
Travis;
This just tripped a SECURITY ALERT in my app during a movie scrape!
Record: 313022 Trailer Path: Path: http://www.youtube.com/watch?v=
Html code in a database record??? Not good.
Please comment.
Joe
Απάντηση από τον/την Joe Rose
στις 8 Ιούνιος 2015 στις 09:32 ΜΜ
Travis;
Sure enough! It executed in this post!
Απάντηση από τον/την Travis Bell
στις 8 Ιούνιος 2015 στις 11:29 ΜΜ
Hi Joe,
I don't believe there's any sanitization on the video field. I've created a new ticket for this here. It's very much related to ticket #887, so I'll do them both at the same time.
Απάντηση από τον/την LordMike
στις 15 Ιούνιος 2015 στις 05:04 ΜΜ
Uh .. just for the record. It is perfectly fine to have HTML or any other form of "code" or "markup" in the database. In fact - it should stay in that format.
It is YOUR job as a consumer to sanitize/encode values when presenting them, because only YOU know which format they should go in. (As an example, for HTML, there are different encodings depending on if you want some text in the body, attributes, javascript or css).
Mike