From d7cdb39e35a615fc28e05fcf2c1a3b26ec88f7ab Mon Sep 17 00:00:00 2001 From: grich88 Date: Wed, 12 Nov 2025 03:30:09 +1100 Subject: [PATCH] Add XSS fix implementation guide (Issue #357) --- SUBMISSION_FIX_XSS.md | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) create mode 100644 SUBMISSION_FIX_XSS.md diff --git a/SUBMISSION_FIX_XSS.md b/SUBMISSION_FIX_XSS.md new file mode 100644 index 00000000..85b2dbd2 --- /dev/null +++ b/SUBMISSION_FIX_XSS.md @@ -0,0 +1,25 @@ +# XSS Fix Implementation Guide + +## Issue #357: Stored XSS in User Profile - first_name Field + +This document provides the theoretical fix for the XSS vulnerability. The exact file location needs to be identified in the codebase. + +## Fix Files Provided + +The fix is provided in: +- `SUBMISSION_FILES/FIX_2_XSS/user_serializer.py` - Django serializer with input sanitization +- `SUBMISSION_FILES/FIX_2_XSS/user_view.py` - Django viewset/views with XSS protection + +## Implementation + +The fix should be applied to the user update endpoint handler that processes `PATCH /api/users/:id/` requests. + +### Key Changes: +1. Input sanitization using `bleach.clean()` to strip HTML tags +2. Output encoding using `django.utils.html.escape()` for safe rendering +3. Validation to check for script tags and JavaScript protocols + +## Note + +Since the exact file location could not be determined through codebase analysis, this fix is provided as a reference implementation. The maintainers should identify the correct file and apply the fix accordingly. +