Topics started by Shlomo_Hassid

1 Topic

S
Shlomo_Hassid
posted in Uncategorized

More security issues with uploaded templates

I recently posted about a security problem caused by the “same origin” of the iframe that is used on the preview window of the the page builder: /topics/possible-security-hole-in-unbounce The Unbounce team is still fixing that - but the problem is deeper than just that.  The Unbounce app allows users to upload and download custom made templates by any one - that includes all the template elements also custom JS scripts - this fact forces Unbounce to follow some strict security protocols concerning JS: Sandboxing js - execution only in preview page. No custom script execution inside the builder page. The first one is problematic and is discussed in the first post mentioned above. The second one is vulnerable two 😕 First, the reason there should not be any script execution in the builder is because a template author may include a script that steals your cookies with your emails, session token etc… and can log as the uploader to his account and : change passwords, steal content

0
J
8 years ago

Badge winners

Show all badges
Terms & ConditionsCookie settings