{"action":"created","issue":{"url":"https://api.github.com/repos/laravel/framework/issues/18639","repository_url":"https://api.github.com/repos/laravel/framework","labels_url":"https://api.github.com/repos/laravel/framework/issues/18639/labels{/name}","comments_url":"https://api.github.com/repos/laravel/framework/issues/18639/comments","events_url":"https://api.github.com/repos/laravel/framework/issues/18639/events","html_url":"https://github.com/laravel/framework/issues/18639","id":219022505,"number":18639,"title":"AbstractPaginator opens XSS vulnerability with query parameters","user":{"login":"nsnyder","id":665780,"avatar_url":"https://avatars2.githubusercontent.com/u/665780?v=3","gravatar_id":"","url":"https://api.github.com/users/nsnyder","html_url":"https://github.com/nsnyder","followers_url":"https://api.github.com/users/nsnyder/followers","following_url":"https://api.github.com/users/nsnyder/following{/other_user}","gists_url":"https://api.github.com/users/nsnyder/gists{/gist_id}","starred_url":"https://api.github.com/users/nsnyder/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nsnyder/subscriptions","organizations_url":"https://api.github.com/users/nsnyder/orgs","repos_url":"https://api.github.com/users/nsnyder/repos","events_url":"https://api.github.com/users/nsnyder/events{/privacy}","received_events_url":"https://api.github.com/users/nsnyder/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2017-04-03T18:33:37Z","updated_at":"2017-04-03T18:52:00Z","closed_at":null,"body":"- Laravel Version: 5.1.30\r\n- PHP Version: 7.0\r\n- Database Driver & Version: N/A\r\n\r\n### Description:\r\nThe `Illuminate\\Pagination\\AbstractPaginator` calls `urldecode()` on the query string. This results in the possibility that dummy parameters can be added to the query string, and then displayed on the page, unencoded.\r\n\r\n### Steps To Reproduce:\r\n```\r\npublic function show(Request $request) {\r\n    // Create the paginator, and append get parameters\r\n    $users= User::paginate(10)->appends($request->get());\r\n    return ('users.index', compact('users'));\r\n}\r\n```\r\n\r\n`users\\index.blade.php`\r\n```\r\n@foreach ($users as $user)\r\n    <li>{{ $user->name }}</li>\r\n@endforeach\r\n{!! $users->render() !!}\r\n```\r\n\r\nIf a malicious user enters into the string, say: `&maldata=\"></a><IMG%20SRC=\"l.png\"%20onerror=\"alert(104);\">`\r\n\r\nThey can cause an XSS attack."},"comment":{"url":"https://api.github.com/repos/laravel/framework/issues/comments/291238116","html_url":"https://github.com/laravel/framework/issues/18639#issuecomment-291238116","issue_url":"https://api.github.com/repos/laravel/framework/issues/18639","id":291238116,"user":{"login":"edenreich","id":16985712,"avatar_url":"https://avatars2.githubusercontent.com/u/16985712?v=3","gravatar_id":"","url":"https://api.github.com/users/edenreich","html_url":"https://github.com/edenreich","followers_url":"https://api.github.com/users/edenreich/followers","following_url":"https://api.github.com/users/edenreich/following{/other_user}","gists_url":"https://api.github.com/users/edenreich/gists{/gist_id}","starred_url":"https://api.github.com/users/edenreich/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/edenreich/subscriptions","organizations_url":"https://api.github.com/users/edenreich/orgs","repos_url":"https://api.github.com/users/edenreich/repos","events_url":"https://api.github.com/users/edenreich/events{/privacy}","received_events_url":"https://api.github.com/users/edenreich/received_events","type":"User","site_admin":false},"created_at":"2017-04-03T18:52:00Z","updated_at":"2017-04-03T18:52:00Z","body":"@nsyder yup I think that issue was fixed already...\r\n\r\n return $this->path\r\n                        .(Str::contains($this->path, '?') ? '&' : '?')\r\n                        .http_build_query($parameters, '', '&')\r\n                        .$this->buildFragment();\r\n\r\nthis is the current code on laravel 5.4"}}
{"actor":{"display_login":"edenreich"}}