Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Provide after assign event for ngrest plugins #83

Closed
nadar opened this issue Apr 4, 2018 · 0 comments
Closed

Provide after assign event for ngrest plugins #83

nadar opened this issue Apr 4, 2018 · 0 comments
Assignees
Milestone

Comments

@nadar
Copy link
Member

nadar commented Apr 4, 2018

In order to secure encode data for model usage the after find event will encode data in text and textarea plugins. When data is not populated trough database (example creating a new model -> save and access/dump/embed user the model values) the input data is not auto encoded this makes xss injection possible when encoding is not done by yourself inside the application.

In order to prevent this the following events will force encoding of the values:

  • after insert
  • after update
  • after refresh
@nadar nadar self-assigned this Apr 4, 2018
@nadar nadar added the bug label Apr 4, 2018
nadar added a commit that referenced this issue Apr 4, 2018
@nadar nadar added this to the 1.1.1 milestone Apr 9, 2018
@nadar nadar added the security label Apr 9, 2018
@nadar nadar closed this as completed Apr 10, 2018
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant