We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
There was an error while loading. Please reload this page.
I believe the WebSub intent verification might be vulnerable to XSS because it reflects the hub.challenge parameter with a HTML content type:
export const instagramSubscription = async (req, res, next) => { try { const subdomain = getSubdomain(req); const models = await generateModels(subdomain); const INSTAGRAM_VERIFY_TOKEN = await getConfig( models, 'INSTAGRAM_VERIFY_TOKEN', ); if (req.query['hub.mode'] === 'subscribe') { if (req.query['hub.verify_token'] === INSTAGRAM_VERIFY_TOKEN) { res.send(req.query['hub.challenge']); } else { res.send('OK'); } } } catch (e) { next(e); } };
Reference: https://www.w3.org/TR/websub/
I believe the WebSub intent verification might be vulnerable to XSS because it reflects the hub.challenge parameter with a HTML content type:
Reference: https://www.w3.org/TR/websub/