Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Fix E_NOTICE when requesting invalid script (#449)
It is possible to trigger an exception by requesting an invalid script path. The following URL path leads to XSS on the exception page, showing two nice popups: http://myapp/_ignition/scripts/--><svg onload=alert(1337)> The exception is: ErrorException Undefined index: --><svg onload=alert(1337)> Illuminate\Foundation\Bootstrap\HandleExceptions::handleError vendor/facade/ignition/src/Http/Controllers/ScriptController.php:14 This happens with facade/ignition 1.18.0 (the last with laravel 6 support) and should be fixed there. The error probably also occurs in all later versions.
- Loading branch information