[demo.weblate.org] Stored Self-XSS via Editor Link in Profile

How it was found

Hi,

Input validation and/or sanitisation is not currently applied to the "Editor Link" in the user's Preferences. Consequently, it is possible to store a JavaScript payload which is stored and executes in the Weblate instance context.

{F178717}

Steps to reproduce

1. Visit the above Preferences page and identify the Editor Link field
2. Populate the field with: javascript:confirm(document.domain)
3. Visit a translation page and select a Source String Location
4. The XSS will trigger upon clicking on a Source String (e.g. main.c)

{F178716}

Please let me know if you require any additional information regarding this issue.

Thanks!