VesperAkshay/qr-code-generator

[Bug]: [Allowing Special Characters in login and register form like these !,<,>,==,&&,|| leads to allwing client side injection attacks]

Aperta

#144 aperta il 8 ott 2024

 (1 commento) (0 reazioni) (1 assegnatario)JavaScript (97 fork)auto 404
buggssoc-exthacktoberfesthacktoberfest-acceptedlevel 2

Metriche repository

Star
 (40 stelle)
Metriche merge PR
 (Metriche PR in attesa)

Descrizione

HELLO @VesperAkshay ,

Description

Security Vulnerability: Client-Side Injection Allowance in Password Field

Issue Description:

The password field currently allows the input of special characters (e.g., <, >, <script>), which can lead to client-side injection attacks. This poses a security risk as it allows malicious scripts to be executed on the client side.

Steps to Reproduce:

  1. Go to the login/Register form.
  2. Enter a valid email in the email field.
  3. In the password field, input a script such as <script>alert(1)</script>.
  4. Submit the form.

Expected Behavior:

Special characters such as <, >, and script tags should be disallowed in the password field to prevent injection attacks.

Actual Behavior:

Special characters are allowed, and malicious scripts can be executed.

###FIX I would like to incorporate proper javascript Input Handling to prevent this type of client side injection or cross scripting attack Please assign me this issue as i would like to contribute regarding this issue with respect secure aspects of coding principle

Screenshots

Screenshot 2024-10-08 102126 Screenshot 2024-10-08 102210

Guida contributor