Yegenim menumun HTML inde script tag buldu — stored XSS JSON-LD breakout (PR #565 TT F1+F2)

Aydin Soke 51-yas Soke Bizim Ev Yemekleri 38-cover 22-yil Ege ev mutfagi + zeytinyagli sebze meze sahibi Vedat thMenu Pro 19 ay. Yegeni Berkay 22-yas ITU Bilgisayar Muhendisligi yaz tatili evdeyken lokantada menu HTML view-source script type application/ld+json blogu icinde product name Soke Yoresel Imambayildi + Sicak Tarhana script alert thmenu script tag breakout JSON.stringify < > escape etmiyor live JavaScript execution menu.thmenu.com stored XSS. Vedat hatirladi gecen ay menu duzenleme YouTube menu hacker test video curious copy-paste test string sadece gormek icin kaydetmis unutmus. Berkay: cookies session token geolocation attacker icin CSP unsafe-inline izin bypass olmuyor. Vedat support yazdi. Engineering 30 dakika reproduce 3 yanlis teori (1) DOMPurify product.name sanitize HTML context icin JSON string degil < > entity legitimate < 250kcal break; (2) CSP nonce-based unsafe-inline kaldir buyuk refactor fragile; (3) product.name < reject legitimate < 250kcal Vegan Salata break. Dogru pattern JSON.stringify wrapper helper < > & U+2028 U+2029 \uXXXX escape valid JSON kalir script tag boundary guvenli. Adli analiz apps/web-menu/src/app/[locale]/[restaurant_slug]/page.tsx script type application/ld+json dangerouslySetInnerHTML __html JSON.stringify menuLd klasik React anti-pattern. RFC 8259 JSON spec sadece quote ve backslash ve control char escape < > valid string char. Same pattern about/page.tsx PR #635 batch III F1 web-landing zaten escapeJsonForScriptTag route ama web-menu sweep unutulmus sibling-surface gap. Database stored XSS scan SELECT product_name FROM products WHERE LIKE %</script% OR %script% Vedat 1 urunde tum thMenu Pro+ 7 restoranda 12 urunde curious operator self-test gercek attacker yok. PR #565 batch TT F1+F2 3-katmanli fix Layer 1 escapeJsonForScriptTag helper apps/web-menu/src/lib/sanitize.ts mirror PR #635 III F1 < \u003c > \u003e & \u0026 U+2028 \u2028 U+2029 \u2029. Tum JSON-LD render path dangerouslySetInnerHTML __html escapeJsonForScriptTag JSON.stringify menuLd. Layer 2 AI-translate echo path sanitize PR #565 F2 AI-translate operator-controlled string AI return value manual_translations stored operator </script> AI translation echo stored XSS round-trip sanitizeAiInput helper XSS pattern detection input <script veya </script var ise AI ya yolla return value reject + log. Layer 3 production database scan + retro purge 12 urunde operator outreach script tag kaldirip normal isimle guncelle 7 operator kaldirdi. Production audit 90-day Cloudflare access log + Sentry breadcrumbs Vedat-pattern operator-set 0 third-party attacker reproduction bug operatör tarafından yaratıldı. Vedat tesekkur email + Berkay Hall of Fame mention + €500 bounty 1-yil Pro credit Soke Bizim Ev. Vedat Twitter yeğenim XSS buldu 48 saat fix CS ogrenci destek 1.4k. Henry Bristol Clifton 21-yo Bristol University CS Aunt Maggie Clifton Tavern Steak and Ale Pie + Garden Peas </script><script>alert paralel ayni Hall of Fame + 1-yil Pro credit Margaret Twitter 2.7k. Pattern script type application/ld+json bloguna JSON content embed JSON.stringify YETERLI DEGIL escapeJsonForScriptTag helper < > & U+2028 U+2029 escape mecbur operator-controlled veya user-uploaded string script-tag breakout stored XSS. Sibling sweep web-landing III F1 + web-menu menu + about TT F1 + web-menu AI translate echo TT F2 + web-admin none PR template checkbox. Implementation escapeJsonForScriptTag shared lib + tum JSON-LD render helper + AI/translation echo input + output sanitize + database scan retro purge + PR template checkbox + quarterly grep audit dangerouslySetInnerHTML + JSON.stringify pattern. PR #565 referans.

İlgili makaleler