[Security] Cross Site Scripting in the operation name value

[Dfte]

Hello,

I was playing with your framework when i came across a XSS in the Operation Name box:
payload: <script>alert()</script>

I have no idea if you guys are interested in that type of vulnerability but i thought it would be nice to inform you anyway :) !

Have a good day,
Defte

[ghost]

thanks!

because caldera is designed as a single-user application, we tend not to prioritize things like this. but -- it's a great find -- and we'd love to fix it. I'll keep this issue open until either we, you or another person in the community pushes a fix. just so it stays in mind.

[Dfte]

Okay! Thanks for responding :)

[github-actions]

This issue is stale because it has been open 20 days with no activity. Remove stale label or comment or this will be closed in 5 days