XSS vulnerability in the units database.

[aw9pf8b9344hh]

I was playing around with the units database and noticed that you could enter whatever you want into the url and it would show on the page, meaning I could execute javascript which can be pretty nasty.

I created an example link below; (Copy/paste into Firefox, Chrome blocks the execution because chrome is smart)
http://www.faforever.com/faf/unitsDB/un ... /script%3E
(This just prints "1337" to the screen and isn't malicious, but a lot of stuff could be done with this.)

Hope this gets fixed soon.

Thanks.

[Legion Darrath]

This doesn't seem to work on Chrome but it does do what you described when testing on Firefox.

[aw9pf8b9344hh]

This doesn't seem to work on Chrome but it does do what you described when testing on Firefox.

Chrome blocks it because they detect XSS most of the time, if you open devtools it will say that it blocked it.