[Bug]: [Allowing Special Characters in login and register form like these !,<,>,==,&&,|| leads to allwing client side injection attacks]
#144 ouverte le 8 oct. 2024
Métriques du dépôt
- Stars
- (40 étoiles)
- Métriques de merge PR
- (Métriques PR en attente)
Description
HELLO @VesperAkshay ,
Description
Security Vulnerability: Client-Side Injection Allowance in Password Field
Issue Description:
The password field currently allows the input of special characters (e.g., <, >, <script>), which can lead to client-side injection attacks. This poses a security risk as it allows malicious scripts to be executed on the client side.
Steps to Reproduce:
- Go to the login/Register form.
- Enter a valid email in the email field.
- In the password field, input a script such as
<script>alert(1)</script>. - Submit the form.
Expected Behavior:
Special characters such as <, >, and script tags should be disallowed in the password field to prevent injection attacks.
Actual Behavior:
Special characters are allowed, and malicious scripts can be executed.
###FIX I would like to incorporate proper javascript Input Handling to prevent this type of client side injection or cross scripting attack Please assign me this issue as i would like to contribute regarding this issue with respect secure aspects of coding principle
Screenshots