XSS when defining header

[aroly]

Hi there,

AuthAnalyzer is vulnerable to XSS when defining headers to add/replace. If you define a header as X-Foo: <img src='https://xxx'> and start the session, the tag will be rendered, and a GET request will be triggered to the img src. Although the impact is obviously low, I think you should know. And it's visually annoying ;)

Cheers,

Antoine

[simioni87]

Hi Antoine,
Thank you for pointing this out. However, this is not related to XSS; it is simply an HTML-rendered Java Swing UI element and has no security impact whatsoever. If it bothers you, feel free to implement a fix and submit a pull request.
Kind regards