The test for malicious use of script tags, feed2js.php lines 50 to 54 are insufficient.
Happy to share proof of concept as DM.
Can be mitigated at the server level. Can also be mitigated at the script level with new code from PHP7+ and/or a larger XSS library.
A PHP-level mitigation might impact project requirements and dependencies, so I wanted to file the issue before offering a PR.
The test for malicious use of script tags, feed2js.php lines 50 to 54 are insufficient.
Happy to share proof of concept as DM.
Can be mitigated at the server level. Can also be mitigated at the script level with new code from PHP7+ and/or a larger XSS library.
A PHP-level mitigation might impact project requirements and dependencies, so I wanted to file the issue before offering a PR.