Skip to content
TalkMoro
New topic

Job apply URL accepts javascript: URLs in older clients

API optional_url allows http(s) and site-relative paths. A forged request with javascript:alert(1) is rejected.

The admin form still did not show a validation error, so staff retried twice and thought the API was down. Please surface the 400 on the field.

5 replies

Fix landed in v2.9.1.

  • Cause: list cache key used the raw query string type.
  • Change: canonicalize before bind, bump cache to v4.
  • Verify: alias filters now return the canonical type.

Closing Job apply URL accepts javascript: URLs in older clients as fixed. Reopen if Valkey still serves a mixed page.

Permalink

Verified on staging and production. Thanks — leaving this up for search.

Permalink

Reproduced on staging. Logs match. Assigning to engineering.

Permalink

Thanks — leaving this up for the next team that searches the same string.

Permalink

Weekly winners

Fixed Solved

Job apply URL accepts javascript: URLs in older clients

Tomás HerreraTomás Herrera·· 994 5

API optional_url allows http(s) and site-relative paths. A forged request with javascript:alert(1) is rejected.

The admin form still did not show a validation error, so staff retried twice and thought the API was down. Please surface the 400 on the field.

#security

Replies 5

Accepted solutionChosen by author or staff
Maya Lin
Member

@maya_cloud

Fix landed in v2.9.1.

  • Cause: list cache key used the raw query string type.
  • Change: canonicalize before bind, bump cache to v4.
  • Verify: alias filters now return the canonical type.

Closing Job apply URL accepts javascript: URLs in older clients as fixed. Reopen if Valkey still serves a mixed page.

Elena Rostova
ModMember

@elena_support

Verified after deploy. Closing as fixed on our tenant.

Priya Nair
Member

@priya_data

Verified on staging and production. Thanks — leaving this up for search.

Sarah Chen
StaffRegular

@sarah_product

Reproduced on staging. Logs match. Assigning to engineering.

Maya Lin
Member

@maya_cloud

Thanks — leaving this up for the next team that searches the same string.

Join the conversation

Sign in or create an account to share your thoughts, solutions, or feedback.