Skip to content
This repository has been archived by the owner on Oct 1, 2024. It is now read-only.

Prevent XSS attack using /auth/enable_cookies #1455

Merged
merged 3 commits into from
May 23, 2020
Merged

Prevent XSS attack using /auth/enable_cookies #1455

merged 3 commits into from
May 23, 2020

Commits on May 23, 2020

  1. Prevent XSS attack using /auth/enable_cookies 

    https://example.com/shopify/auth/enable_cookies?shop=%27%22%3C/title%3E%3C/style%3E%3C/textarea%3E%3C/noscript%3E%3C/script%3E--%3E%3Cdtfy%3E%3Cscript%3Ealert(%27hello%20world%27)%3C/script%3E

Thanks to @nhusher
    @seamusabshere
    seamusabshere committed May 23, 2020
    Configuration menu
    Copy the full SHA
    114ce1b View commit details
    Browse the repository at this point in the history

  2. 2 more spots

    @seamusabshere
    seamusabshere committed May 23, 2020
    Configuration menu
    Copy the full SHA
    4b7179e View commit details
    Browse the repository at this point in the history

  3. found another one

    @seamusabshere
    seamusabshere committed May 23, 2020
    Configuration menu
    Copy the full SHA
    8cce0f8 View commit details
    Browse the repository at this point in the history