Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

jsContext does not escape </script> tags properly #76

Open
carsonreinke opened this issue Oct 11, 2019 · 1 comment
Open

jsContext does not escape </script> tags properly #76

carsonreinke opened this issue Oct 11, 2019 · 1 comment

Comments

@carsonreinke
Copy link

When doing window.stencilBootstrap("{{page_type}}", {{jsContext}}).load(); under https://github.com/bigcommerce/cornerstone/blob/master/templates/layout/base.html#L53, the context often contains a "description" or HTML blob.

Browser interpretation of '</script>' actually has the first ' as the last line in a JS block and ' would actually appear on the page.

This should be properly encoded by escaping /.

@davidmadi
Copy link

Thank you so much for identifying it! I'm setting special protection on my product's custom fields to avoid that until fixed.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

No branches or pull requests

2 participants