Cross-Site Scripting Vectors (XSS) about arrow-js

[justin-schroeder]

Definitely. It actually is fixed in the arrow-refactor-2 branch (as well as a bunch of perf improvements). However, that said, arrow is still an experiment and I’m looking for the right tradeoffs to make. There will likely be a arrow-refactor-3 branch perhaps even a 4th as we try to path find here.

[cferdinandi]

This is also generally only a problem with third party data. Most people don’t XSS attack themselves. Still useful to be aware of.

[madelson]

Will these be fixed?

[madelson]

@justin-schroeder thanks for the update. Do you have a sense of when the next version would be released / how breaking it would be? Is there a good way to follow progress? I'm starting a new project and interested in trying Arrow. Curious what the upcoming changes and timelines are like.

@cferdinandi the code you show has these hard-coded into the templates themselves. I'm more worried about an XSS attack where I include some data as text content and arrow fails to escape it such that it injects tags/behavior onto the page. Have you seen anything like that? Am I thinking about this the right way?

[cferdinandi]

@madelson That's exactly right! I hard-coded them just for example purposes, but in real-life situations, the danger is user-generated or API-derived data that you use in your templates containing malicious code.