Holy hell, OP.
What prevents me from just calling "postMessage" directly myself, which does nothing to prevent the "sanitation" that the replace function call there is supposed to do?
Please sanitize messages on the server instead.
What prevents me from just calling "postMessage" directly myself, which does nothing to prevent the "sanitation" that the replace function call there is supposed to do?
Please sanitize messages on the server instead.
As an exercise I'd love it someone actually posted a payload to exploit that regex.