From f6ee8ceebd915fdd167a22e56836a9f7be84791e Mon Sep 17 00:00:00 2001 From: Michael Cade Date: Fri, 6 Jan 2023 22:57:27 +0000 Subject: [PATCH] Add Day 6 - Hands-On: Building a weak app --- 2023/day06.md | 4 ---- 1 file changed, 4 deletions(-) diff --git a/2023/day06.md b/2023/day06.md index 342c480..d1fbad9 100644 --- a/2023/day06.md +++ b/2023/day06.md @@ -184,10 +184,6 @@ Now edit app/views/bootcamps/show.html.erb and make the description field a raw <%=raw @bootcamp.description %>

``` -I recorded the steps to get to this point below. Hopefully this renders well, something I found GitHub now supports is embedding videos into markdown. (pretty cool!) - -![](images\day06-stage1-creatingapp.mp4) - Now why this is all relevant is that using raw in the description field means that this field now becomes a potential XSS target. Or cross-site scripting. This can be explained better with a video [What is Cross-Site Scripting?](https://youtu.be/DxsmEXicXEE)