Comments (2)
cmfcmf
commented on June 7, 2024
2
One thing to be careful about is making sure to correctly handle users entering http://127.0.0.1/..., http://localhost/..., 192.168.0.123/..., etc. as link. If we blindly call https://localhost/... from our server, we might be executing unintended actions at internal system resources, such as ElasticSearch.
Edit: Users could even provide a link http://malicious.com/... and set up the DNS to point to 127.0.0.1.
from adventurelookup.
cmfcmf
commented on June 7, 2024
We could also simply forbid HTTP thumbnail images, given that almost every website uses HTTPS anyways. This might be the easiest fix for this issue.
from adventurelookup.
Related Issues (20)
- Replace selectize library HOT 4
- Add a page to see a users reviews HOT 1
- Fix subdomain redirects on adventurelookup.com
- Using search drop down under System/Edition filter HOT 3
- "Similar and Related Adventures" missing some expected adventures HOT 2
- Low contrast in sidebar filter view HOT 3
- Improve accessibility of AdventureLookup
- Fix Heroku deployments HOT 1
- Languages HOT 1
- A tag for "Free" modules HOT 6
- Age/Size for dragons? HOT 2
- Allow user to change email address
- Mobile Usability issues detected by Google
- Change to Profile layout. HOT 4
- Allow users to delete their own accounts HOT 1
- Add a License Field
- Display number of miniatures to adventure monster list
- Ability to filter search by user bookmark/list HOT 1
- Publisher and Setting HOT 1
- Add feild "Optimised for APL"
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from adventurelookup.