farzadso / apexnoti--oracle-apex-browser-notifications Goto Github PK

Hi @farzadso
just to let you know, please be sure to escape your inputs correctly to reduce Security Problems like XSS...
If Notification Title or Body comes from a Hidden Item which is set from DB you´ll never know what "bad" Users type in :)
I suggest you to use apex_escape.html to escape all inputs (title, body, ...).
You can test the security vulnerability by yourself, just insert this as title:

"); alert("XSS Test"); console.log("

Then you will see an alert popping up...

Ah and btw: Ff you export with APEX 5.1 the plugin export file is only compatible with other 5.1 and above instances...

Great to see the APEX Plugin community is growing that fast!;)

Best wishes
Daniel