XSS Vulnerability

[ghost]

Hi there.

I am not sure if this has been patched already, but here's a vulnerability that can make Polymer execute arbitrary code. Please don't allow this in Polymer, as it opens up security holes.

Whitepaper: http://ruxcon.org.au/assets/slides/CSP-kuza55.pptx

[sjmiles]

It's not clear how it's possible to inject into <element> like that as an XSS attack. There is no input that feeds that tag. If the attacker controls that HTML, they can simply include their script directly, Polymer is not relevant. Can you help me understand how this is an exploit?

Fwiw, it's not possible to 'remove all eval' from Polymer. However, to ensure a Polymer application is CSP compliant, one can run it through the vulcanize tool.

Thank you for the report, please let us know if you find other problematic scenarios.

[sorvell]

Closed due to age, please re-open if this is still an issue.