mephisto-xss.txt

`Hello everyone!  
  
Current bleeding-edge version of Mephisto blog is vulnerable to XSS.   
Comment's author name accept javascript code. If admin approves/   
rejects comments manually, he have to load all unapproved comments,   
so it's possible to fetch his session id.  
  
Example  
  
Add new comment with the following author name: <script>alert   
(document.cookie)</script>  
Then from admin's overview section check this comment - you'll see   
message with cookie.  
If you manually approve your comments, check list of pending comments.  
  
How to fix it  
  
patch for <approot>/app/helpers/application_helper.rb :  
  
5c5  
< return comment.author if comment.author_url.blank?  
---  
> return h(comment.author) if comment.author_url.blank?  
  
Best wishes!  
Sergey Tikhonov  
`