Do not render custom callbacks with potentially unsecure function names. #5

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Open

suligap wants to merge 1 commit into jpadilla:master from suligap:validate-callback-param

suligap commented May 28, 2015

See http://www.benhayak.com/2015/05/stealing-private-photo-albums-from-Google.html for context. Also, basic input validation never hurt anyone :)


          Do not render custom callbacks with potentially unsecure function names.

d53a30a

joesolly commented Aug 6, 2018

👍 on this change. Hopefully we can get it merged and deployed.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet