Bad escape of query result on initial load of page about express-graphql

[jamesbehr]

This is actually a reflected XSS vulnerability. You can reproduce this on the SWAPI example by using this link.

Or you can input the "query"

</script><script>alert('XSS');</script>

and then refresh the page.

[leebyron]

Thanks for the report, but can you offer more details? For example is there a simple query that always causes this issue to reproduce? Perhaps one you can illustrate with http://graphql-swapi.parseapp.com/?

[19h]

@leebyron the results have to be values that include nested html, I'm afraid that's not the case in the StarWars-example