attention Cross-site scripting

if you use TvTagCloud snippet and friendly URLs something like this:

http://www.domain.net/tags.html?tags=%3Cimg%20src=%22http://www.oxfordreference.com/media/images/6115_0.jpg%22%20onerror=alert%28document.cookie%29;%3E

//
after ?tags or something other (query etc.) add:
%3Cimg%20src=%22http://www.oxfordreference.com/media/images/6115_0.jpg%22%20onerror=alert%28document.cookie%29;%3E

is broken your site



i test in evo 103 and 0.9.6.2
PHP Version 5.1.6
mysql: 5.0.77
server: centOS
Apache: 2.0 Handler
ditto-2.1.0

//

tvtagcloud call:
[!TvTagCloud? &limit=`50` &parent=`0` &landing=`35` &tvTags=`tags` &showCount=`0` &steps=`1,10,20,50,100` &styles=`tag5,tag4,tag3,tag2,tag1` &sort=`random` &displayType=`cloud`!]

ditto call:

[[Ditto? &tpl=`tags_shower` &parents=`0` &extenders=`tagging` &tagData=`tags` &tagDelimiter=`,` &depth=`10` &paginate=`1` &sortBy=`pub_date` &sortDir=`DESC`]]

tpl:
<h3><a href="[~[+id+]~]" title=" [+title+] ">[+title+]</a></h3>
<p>[+content:notags:esc:word_limit=`35`+]<a title=" [+pagetitle+] " href="[~[+id+]~]">read</a></p>

I do not know where the problem..maybe in ditto but today i make test with modxcms.com and i get this:


IS THAT NORMAL?

This is scary!

I can’t get this result with Evo 1.04 (1.04 fixes some security issues).

We fixed it the other day. Was a bit of oversight in the Add-ons search code, and nothing to do with anything MODx related (other than the fact it was running in MODx of course).

Quote from: Mithrandir at Jun 12, 2010, 03:50 PM

I can’t get this result with Evo 1.04 (1.04 fixes some security issues).

we make test with 1.0.4 and i have same results

how does this go?
do we have a security consideration for the add-on developers?

Wait there seems to be two issues at hand here, I think. The Extras on the main site and an Add-on for Evo? The Extras code has nothing to do with any released Add-ons.

Quote from: rthrash at Jun 23, 2010, 09:40 AM

Wait there seems to be two issues at hand here, I think. The Extras on the main site and an Add-on for Evo? The Extras code has nothing to do with any released Add-ons.

I believe it comes from the same hole: the add-on, not the core.
So my question was about the MODx’s policy of add-on’s testing/assessment.
Perhaps you should pick one individual with a good web-security knowledge to screen out the security measurement.
I’m not saying you’re not good, but you can not do all alone.

Eventually we’ll have a slate of reviewed Add-ons, but for now it’s buyer beware.