Octobercms v3.5.15 has a Reflective XSS vulnerability about docs

[daftspunk]

Hi @Hebing123

This is debug information. Turn off debug mode (APP_DEBUG=false) before testing further.

Please also review the security policy for important information about disclosure: https://github.com/octobercms/october/security/policy

Best regards

[Hebing123]

Hello @daftspunk ,
I don't agree with you.
The debug mode of Octobercms is enabled by default, which means it needs tobe manually disabled by the administrator. There is no question that if you do not turn off debug mode manually, you will create reflective XSS vulnerabilities.

For example, CVE-2021-3129, this vulnerability is occurring in Laravel Debug mode, Do you think it is harmless?? This is clearly unreasonable.
Laravel does not have Debug enabled by default, and Laravel in Octobercms has debug mode enabled by default.

I found many Octobercms production environments online with debug mode enabled.So this is a vulnerability worth fixing, it has some harm.

Repair method:

1. Change the error output mode of Laravel and filter the string in the uri.
2. The debug mode is disabled by default.

[daftspunk]

Hi @Hebing123

I've taken note of this.

The application default settings are based on Laravel.

In modern versions, there are several system warnings displayed in the admin panel when a system is not configured for production. There is a section dedicated to production configuration in the documentation.

Please follow the correct procedures in the future.

Thank you.