Stored XSS Flaw Found in Next.js Demo Store via Malicious SVG Upload

·6 views

A stored cross-site scripting (XSS) vulnerability was discovered in OopsSec Store, a deliberately vulnerable Next.js e-commerce app used for security training. An attacker with admin access could upload a malicious SVG file as a product image, embedding JavaScript that executes automatically for every visitor who views the product page. The flaw existed because the server trusted the client-supplied Content-Type header without inspecting actual file contents, and the app rendered SVGs using an img tag that allowed script execution. The vulnerability affected multiple endpoints, including the product page, admin preview, and the direct file URL. Recommended fixes include magic-byte file inspection, server-side SVG sanitization with DOMPurify, and strict Content-Security-Policy headers on the uploads directory.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer Releases LocalMind, a Free AI Agent Framework That Runs Entirely Offline

A developer has released LocalMind, an open-source AI agent framework designed to run entirely on a user's local machine without requiring any cloud API keys or subscriptions. The project was motivated by frustration over recurring API costs and concerns about sending personal data to third-party servers. LocalMind supports local language models via Ollama — including Llama 3.2, Mistral, and DeepSeek — and can also run inference directly in the browser using WebGPU. The framework features a ReAct reasoning loop, custom tool calling, real-time token streaming, and conversation memory with snapshot and restore capabilities. The project is publicly available on GitHub and can be installed via npm.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why Your API Passes curl Tests but Fails in the Browser: CORS Explained

Cross-Origin Resource Sharing (CORS) is a browser security mechanism that blocks web pages from making requests to a different origin — such as a different port — than the one that served them. Unlike curl, which sends requests without any concept of origin, browsers enforce this policy to prevent malicious sites from exploiting stored user credentials on third-party services. When an API call involves methods like POST or DELETE, or includes headers such as Authorization, the browser first sends a preflight OPTIONS request to verify the server permits cross-origin access. The server must respond with the appropriate access-control headers; if it does not, the actual request is never made, which explains why server logs may show a 200 status while the browser console reports an error. A lightweight Go middleware using only the standard library can handle CORS correctly by checking allowed origins, setting the required headers, and short-circuiting preflight requests before they reach route handlers.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

From Napster to Chord: How Peer-to-Peer Systems Solved the File Lookup Problem

Peer-to-peer file sharing distributes storage across participants, but the harder challenge has always been answering which peer holds a given file at any moment. Napster addressed this with a centralized directory that tracked file locations without hosting the files themselves, making searches fast but creating a single point of failure. Gnutella later attempted to fix this by flooding search queries across the network, eliminating central control but generating unsustainable traffic as the network scaled. Structured overlay networks and distributed hash tables, including Chord, eventually offered a more elegant solution by routing lookups in logarithmic steps rather than querying every peer. This evolution illustrates how decentralizing data is straightforward, but decentralizing the knowledge of where that data lives remains the genuinely difficult engineering problem.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why PMOs Are Losing Relevance in the Age of Agile Delivery

Project Management Offices are increasingly being dismantled or sidelined not because agile teams reject governance, but because many PMOs failed to evolve beyond enforcing traditional documentation and compliance. A recurring friction point is PMOs demanding Gantt charts and formal reports from agile teams that already track progress through backlogs, velocity metrics, and working software. Critics argue that PMOs which were eliminated during agile transformations were largely victims of their own inability to demonstrate value beyond the paperwork they generated. While directive PMOs still make sense in predictable environments like government infrastructure or financial services, they tend to obstruct continuous delivery in product-focused organizations. The core question facing PMOs today is no longer about process compliance, but whether they can meaningfully contribute to strategic alignment and business outcomes that senior leadership actually values.

0 comments Read more at DEV Community