Automate XSS vulnerabilities detection in Odoo's HTML fields.

Abstract

During my 15-week internship at Odoo, I automated the detection of cross-site scripting in the software's HTML fields. Ensuring security in web applications is an important and continuous task. This rule applies to Odoo, a worldwide and ever-changing ERP software. To detect cross-site scripting in the software's HTML fields, I built an internal test that introduces a malicious payload in each target field of an Odoo database. Using two different crawlers, one for HTML-only pages and another one for JavaScript-rendered pages, the test crawls through all of the server pages, detecting and reporting unsanitized payloads. This test will help Odoo improve security measures against a vulnerability that remains, to this day, a highly prevalent vector of attacks in web applications.