My school uses the website WebAssign for online math and science homework. One of WebAssign's features is a "My Notes" section that allows you to input notes for a problem and come back to it later without actually submitting the answer.
The "My Notes" dialog has an <input>
button to edit the text, and a <div>
whose innerHTML
is the raw contents of the notes. This means that, for example, writing π
in the notes box will cause π to appear in the rendered view.
Another interesting side effect is that it's the rendered HTML that's copied into the box for further editing. For example, writing &gt;
and then pressing "Edit" and "Save" repeatedly would result in the sequence &gt;
→ >
→ >
showing up in the editor.
You can also break the page by writing something like </div></body></html>
, which is injected into the HTML raw.
My question is whether there's anything inherently dangerous to the server or any other users of the website here. It would seem to me that there isn't—I have no indication that the server is actually executing any scripts, etc. that I might put in there, only storing the text and feeding it back later. However, there also seems to be something just wrong about this lack of sanitization in a production website. So is this a problem?