help wanted
仓库指标
- 星标
- (15 个星标)
- PR 合并指标
- (30 天内没有已合并 PR)
描述
The ?_raw=column mechanism makes me a little nervous. It feels like it could be used for XSS, since it allows attackers to inject exact values into a page that is served by Datasette - e.g. https://latest-with-plugins.datasette.io/fixtures.css?sql=select+%27%3Cscript%3Ealert(%22evil%2C+perhaps%22)%3C%2Fscript%3E%27+as+evil%3B&_raw=evil
:root {
--evil: <script>alert("evil, perhaps")</script>;
}
But that page is served with the text/css content-type - it's not HTML.
Could a browser be tricked into rendering it as HTML, in which case it would open up a XSS hole in the hosting Datasette instance?