[Bounty] Tronscan V2 - Able to put invalid characters in Representative Website URL

[robincarlo84]

Bug Report

As you can see on the screenshot, you are able to put invalid characters in the Website URL field

Not sanitizing the input fields makes your site prone to XSS Injections.

You can reproduce this by:

1. Apply to be a super representative candidate
2. Enter a valid website address. e.g. https://www.sample-url.com
3. Once application is approved, go back to your account then change website
4. Change website with this: "><img src=d onerror=prompt(document.cookie);>
   Note: include double quote(") char.

OS

Mac

Browser

Chrome
FF
Safari

Reward Information

Voluntary donation: 0x6562eb37a210a0949fd502f2a746284a38f4e9cc
Email: [email protected]