Possible XSS issues reported in JS

More
3 years 3 weeks ago #127758 by ddimitrov
ddimitrov created the topic: Possible XSS issues reported in JS
I host a LimeSurvey instance for a community of medical researchers. I'm thinking about updating to 2.06+ 151018
As part of the compliance steps that we do we perform a static VeraCode ( www.veracode.com/ ) scan of the code. This is an automated and it sometimes returns false positives, but for the most part it's pretty spot-on.
The static code scan for LimeSurvey 2.06 151018 returned a number of XSS medium-level threats.
I can provide a report that may help you determine if these are legitimate or false positives. I don't want to post it openly here for obvious reasons. You can contact me to request it and I will provide the details.
Thank you,
Dimitar

Please Log in or Create an account to join the conversation.

More
3 years 3 weeks ago #127766 by holch
holch replied the topic: Possible XSS issues reported in JS
There was a security audit just recently:
www.limesurvey.org/en/blog/76-limesurvey...ity-advisory-10-2015

So I guess the current code now should be fine. But of course, this can never be outruled.

Ideally you make a bug report and add the report from VeraCode, because then you reach the developers directly. They don't show up on the forum everyday.

I'm not a LimeSurvey GmbH member. I answer at the LimeSurvey forum in my spare time. No support via private message.
Some helpful links: Manual (EN) | Question Types | Workarounds
The following user(s) said Thank You: ddimitrov

Please Log in or Create an account to join the conversation.

More
3 years 3 weeks ago #127780 by DenisChenu
DenisChenu replied the topic: Possible XSS issues reported in JS

holch wrote: Ideally you make a bug report and add the report from VeraCode, because then you reach the developers directly. They don't show up on the forum everyday.

+1

Assistance on LimeSurvey forum and LimeSurvey core development are on my free time.
I'm not a LimeSurvey GmbH member, professional service on demand (or search sondages pro).
An error happen ? Before make a new topic : remind the Debug mode .

Please Log in or Create an account to join the conversation.

Start now!

Just create your account and start using Limesurvey today.

Register now
Join our Newsletter!