VesperAkshay/qr-code-generator

[Bug]: [Allowing Special Characters in login and register form like these !,<,>,==,&&,|| leads to allwing client side injection attacks]

開放

#144 建立於 2024年10月8日

 (1 則留言) (0 個反應) (1 位負責人)JavaScript (97 個分叉)auto 404
buggssoc-exthacktoberfesthacktoberfest-acceptedlevel 2

倉庫指標

星標
 (40 顆星)
PR 合併指標
 (PR 指標待抓取)

描述

HELLO @VesperAkshay ,

Description

Security Vulnerability: Client-Side Injection Allowance in Password Field

Issue Description:

The password field currently allows the input of special characters (e.g., <, >, <script>), which can lead to client-side injection attacks. This poses a security risk as it allows malicious scripts to be executed on the client side.

Steps to Reproduce:

  1. Go to the login/Register form.
  2. Enter a valid email in the email field.
  3. In the password field, input a script such as <script>alert(1)</script>.
  4. Submit the form.

Expected Behavior:

Special characters such as <, >, and script tags should be disallowed in the password field to prevent injection attacks.

Actual Behavior:

Special characters are allowed, and malicious scripts can be executed.

###FIX I would like to incorporate proper javascript Input Handling to prevent this type of client side injection or cross scripting attack Please assign me this issue as i would like to contribute regarding this issue with respect secure aspects of coding principle

Screenshots

Screenshot 2024-10-08 102126 Screenshot 2024-10-08 102210

貢獻者指南