player.setDisplayName("");
connection-lost
All 7 comments
I dont see why fixing this is necessary
wioxjk
on 2 May 2017
When player is able to create custom markers, or creating a marker through another plugin, or able to change their name.
connection-lost
on 2 May 2017
Fixing this is necessary. It is a security vulnerability. HTML should be sanitized after all.
chuushi
on 2 May 2017
@connection-lost
That is more like a feature ;)
@SimonOrJ
Yes, it is a vulnerability. I must also admit that I completely forgot that dynmap can be configured to require authentication (something that I have never used). In that case it is not a waste of time fixing this.
Totally agree that code should be correct.
Otherwhise, I can't see why this is a really dangerous thing in this case - yet.
wioxjk
on 2 May 2017
Not considering whether "it is okay for server admin to xss attack a player".
But sometimes a player can change their name, or create a custom marker to show on dynmap. Say I am a bad player and create a marker called "My Awesome Shop". Then everyone on the dynmap will be redirected to that website.
connection-lost
on 2 May 2017
@connection-lost
Excellent point!
wioxjk
on 3 May 2017
Should be fixed in today's dev builds for 2.6 and 3.0
mikeprimm
on 8 Jul 2018
Related issues
wtchappell
路
4Comments
thetakodev
路
4Comments
MissFox0810
路
3Comments
Blueeyestar
路
3Comments
mibby
路
4Comments
Most helpful comment
Not considering whether "it is okay for server admin to xss attack a player".
But sometimes a player can change their name, or create a custom marker to show on dynmap. Say I am a bad player and create a marker called "My Awesome Shop". Then everyone on the dynmap will be redirected to that website.