Improper Input Validation on User's Location on PUT /WhoService/putLocation Could Affect Availability/Falsify Users
该报告还没有中文解读。
原文摘录
摘自原文（3710 字符中的一小部分）
Summary: Note: I noticed that that the team has fixed issues like an XSS that's caused only from a header value (typically OOS since it's not directly exploitable) https://github.com/WorldHealthOrganization/app/pull/855, so in the spirit of this I'm also reporting another "good-to-fix" issue.
原文中的代码
Future<void> _allowLocationSharing() async {
try {
await Location().requestPermission();
if (await Location().hasPermission() == PermissionStatus.granted) {
if (await Location().requestService()) {
LocationData location = await Location().getLocation(); …默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 WHO COVID-19 Mobile App 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @spaceraccoon · 版权归作者与 WHO COVID-19 Mobile App 所有