Karen's XSS

This is a simple React app that allows users to submit complaints and react to them.

⚠️ Security Warning

This application contains intentional security vulnerabilities for educational purposes. It should only be run in a controlled, isolated development environment. Never deploy this application to a production environment or expose it to the public internet.

Running the app

yarn install
yarn run dev

Testing

Install testing dependencies:

yarn test:install

Run the tests:

yarn test

Run tests with UI:

yarn run test:ui

Vulnerabilities

XSS in username (stored xss)

The username is rendered in the complaint feed without sanitization.

<div className="text-sm text-gray-600 mb-2" dangerouslySetInnerHTML={{ __html:
`Posted by: ${complaint.username}` }} />

XSS in complaint text (stored xss)

The complaint text is rendered in the complaint feed without sanitization.

<div
  className="text-gray-800 mb-4"
  dangerouslySetInnerHTML="{{"
  __html:
  complaint.description
  }}
/>

http://localhost:3000/?query=%3Cimg%20src=x%20onerror=%22alert(5)%22/%3E

XSS in search query (reflected xss)

The search query is rendered straight from the URL.

{searchResult && (
<div
  className="p-4 bg-karen-primary-50 rounded"
  dangerouslySetInnerHTML="{{"
  __html:
  searchResult
  }}
/>
)}