Very vulnerable to a XSS

[TH3AL3X]

There should be something to sanitize the code, people can run an XSS without problems..

[Flame442]

If you have a serious security vulnerability to report, I am reachable on discord in https://discord.gg/red as Flame#2941. This post does not have enough information for me to understand what is going on, so I urge you to send me a private message if you have a legitimate vulnerability to report.

[TH3AL3X]

If you have a serious security vulnerability to report, I am reachable on discord in https://discord.gg/red as Flame#2941. This post does not have enough information for me to understand what is going on, so I urge you to send me a private message if you have a legitimate vulnerability to report.

For example in the inputs an XSS can be executed

[NonImportantPerson]

Yeah but this does not go to any server or even get displayed to anyone else besides you when do that and you can use alert in dev tools so?

[mcdcam]

I wouldn't call this a serious or exploitable vulnerability, however, a script injection attack is possible if a user pastes a malicious string into one of the fields. Of course, this would be as good as useless as AFAIK the site doesn't store anything valuable other than the values of the other fields, so there's nothing for an attacker to take.

This is still an issue as entering certain values (eg if you want <something> to appear in one of your fields) will make them not show up as they are seen as HTML. (see screenshot)

The issue is that there is no input sanitisation performed in the updateEmbed function, for example here:

discord-embed-sandbox/js/index.js

Lines 44 to 45 in c684c6e

	if (embed.url) {
	$('.embed-inner').append('<div class="embed-title"><a href="' + embed.url + '">' + embed.title + '</a></div>');

If the input is first properly sanitised, for example with something like this, or ideally a proper sanitisation library, the issue would be resolved.

[djfjfofoc3]

Considering, afaik, you cannot add URL-parameters for an embed (ie ?title=test&description=<script>alert('hi')</script>&fields=[title=a;value=b;inline=1]), this doesn't seem like a Cross-Site-Scripting Vulnerability, rather a trivial bug.
However, I would still like to see sanitation, so forks of the project which may allow that aren't unknowingly vulnerable to this.
Will likely open a PR that fixes this in a bit.

EDIT: opened a PR that fixes this; see #25