Skip to content

Raw Malicious Content Stored in Database Due to Missing Changeset Validation #2555

Description

@khushal-winner

Describe the bug
Stored malicious HTML/JS payloads (e.g. <script>alert('XSS')</script>) are accepted and saved in player/game names without any validation or sanitization.
Phoenix auto-escapes output so no XSS executes now, but raw dangerous content stays in the database.

Expected behavior
Player and game names should be validated/sanitized on save reject or strip HTML/JS tags and other unsafe characters.

Screenshot

Image

Desktop (please complete the following information):

  • OS: Windows / macOS / Linux
  • Browser: Chrome / Firefox / Edge
  • Version: Latest

Additional context

  • No content validation in changesets (only length/required checks).
  • Raw HTML/JS stored in DB → big risk if someone later uses raw() in templates, adds exports (CSV/JSON), emails, or admin views.
  • Current Phoenix escaping protects against immediate XSS, but this is a future-proofing / data integrity issue.

Metadata

Metadata

Labels

bugSomething isn't workingcopi.owasp.orgelixirPull requests that update elixir codehelp wantedExtra attention is needed

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions