[Security] Stored XSS in platform name

[edoardottt]

Tested version: (latest, docker)

Steps to reproduce the vulnerability:

• Login in the application.
• Click on settings.
• Set "<script>alert(document.domain)</script> as platform name and save.
• Logout and XSS will fire.

[petersirka]

@edoardottt Thank you. In the Total.js 4 framework, I have fixed the issue totaljs/framework4@e2cea69. There was a missing encoding configuration value for the specific declaration.

You can test it with the Flow: $ npm install total4@beta.

[edoardottt]

Amazing! You should roll out a patched image too :)

have a nice day!