lemmy.world is a victim of an XSS attack right now and the hacker simply injected a JavaScript redirection into the sidebar.

It appears the Lemmy backend does not escape HTML in the main sidebar. Not sure if this is also true for community sidebars.

EDIT: as a demo, your web browser is probably telling you that it’s blocked a popup or something, you should see an alert I’ve injected

  • Cyclohexane@lemmy.mlEnglish
    2·
    1 year ago

    It is one of the most well known, but it also is easy to miss, evidently from how often it happens despite it being very well known.

    It’s very easy to fix once it’s known, but it is easy to go unnoticed.

    Unless you somehow think that most app developers are incompetent, in which case I ask again: show me your better version.

    • crystal@feddit.deEnglish
      1·
      1 year ago

      I can confidently say that in not a single company project I did frontend development for did I ever leave user input unsanitized.

      But I did not ever create a Lemmy like project, that is true.