History | Log In     View a printable version of the current page.  
Issue Details (XML | Word | Printable)

Key: APF-880
Type: Improvement Improvement
Status: Resolved Resolved
Resolution: Fixed
Priority: Minor Minor
Assignee: Matt Raible
Reporter:
Votes: 0
Watchers: 0
Operations

If you were logged in you would be able to see more operations.
AppFuse

messages.jsp - cross site scripting

Created: 12/Sep/07 03:41 AM   Updated: 17/Mar/08 01:03 PM
Component/s: Web - JSF, Web - Spring, Web - Tapestry
Affects Version/s: 2.0-RC1
Fix Version/s: 2.0 Final

Environment: winxp, jetty, postgres, IE


 Description  « Hide
I use addError(...) to reflect messages to user - including user input

if user input is something like <script>alert('hi');</script> - JS is being executed.

old:
<c:out value="${msg}" escapeXml="false"/>

I suggest:
<c:out value="${msg}" escapeXml="true"/>

same goes with errors. -> ${error}

 All   Comments   Change History   FishEye      Sort Order:
Matt Raible - 13/Sep/07 04:36 PM
It's unfortunate to have to change this because we use HTML to make certain parts of messages more apparent:

User information for <strong>{0}</strong> has been added successfully.

Oh well, XSS is more important I suppose.

http://www.webhaus.com.br/forum/viewtopic.php?t=5170
http://www.webhaus.com.br/forum/viewtopic.php?t=5169
http://www.webhaus.com.br/forum/viewtopic.php?t=5168
http://www.webhaus.com.br/forum/viewtopic.php?t=5167
http://www.webhaus.com.br/forum/viewtopic.php?t=5166
http://www.webhaus.com.br/forum/viewtopic.php?t=5165
http://www.webhaus.com.br/forum/viewtopic.php?t=5164
http://www.webhaus.com.br/forum/viewtopic.php?t=5163
http://www.webhaus.com.br/forum/viewtopic.php?t=5162
http://www.webhaus.com.br/forum/viewtopic.php?t=5161
http://www.webhaus.com.br/forum/viewtopic.php?t=5160
http://www.webhaus.com.br/forum/viewtopic.php?t=5159
http://www.webhaus.com.br/forum/viewtopic.php?t=5158
http://www.webhaus.com.br/forum/viewtopic.php?t=5157
http://www.webhaus.com.br/forum/viewtopic.php?t=5156
http://www.webhaus.com.br/forum/viewtopic.php?t=5155
http://www.webhaus.com.br/forum/viewtopic.php?t=5154
http://www.webhaus.com.br/forum/viewtopic.php?t=5153
http://www.webhaus.com.br/forum/viewtopic.php?t=5152
http://www.webhaus.com.br/forum/viewtopic.php?t=5151
http://www.webhaus.com.br/forum/viewtopic.php?t=5150
http://www.webhaus.com.br/forum/viewtopic.php?t=5149
http://www.webhaus.com.br/forum/viewtopic.php?t=5148
http://www.webhaus.com.br/forum/viewtopic.php?t=5147
http://www.webhaus.com.br/forum/viewtopic.php?t=5146
http://www.webhaus.com.br/forum/viewtopic.php?t=5145
http://www.webhaus.com.br/forum/viewtopic.php?t=5144
http://www.webhaus.com.br/forum/viewtopic.php?t=5143
http://www.webhaus.com.br/forum/viewtopic.php?t=5142
http://www.webhaus.com.br/forum/viewtopic.php?t=5141
http://www.webhaus.com.br/forum/viewtopic.php?t=5140
http://www.webhaus.com.br/forum/viewtopic.php?t=5139
http://www.webhaus.com.br/forum/viewtopic.php?t=5138
http://www.webhaus.com.br/forum/viewtopic.php?t=5137
http://www.webhaus.com.br/forum/viewtopic.php?t=5136
http://www.webhaus.com.br/forum/viewtopic.php?t=5135
http://www.webhaus.com.br/forum/viewtopic.php?t=5134
http://www.webhaus.com.br/forum/viewtopic.php?t=5133
http://www.webhaus.com.br/forum/viewtopic.php?t=5132
http://www.webhaus.com.br/forum/viewtopic.php?t=5131
http://www.webhaus.com.br/forum/viewtopic.php?t=5130
http://www.webhaus.com.br/forum/viewtopic.php?t=5129
http://www.webhaus.com.br/forum/viewtopic.php?t=5128
http://www.webhaus.com.br/forum/viewtopic.php?t=5127
http://www.webhaus.com.br/forum/viewtopic.php?t=5126
http://www.webhaus.com.br/forum/viewtopic.php?t=5125
http://www.webhaus.com.br/forum/viewtopic.php?t=5124
http://www.webhaus.com.br/forum/viewtopic.php?t=5122
http://www.webhaus.com.br/forum/viewtopic.php?t=5121
http://www.webhaus.com.br/forum/viewtopic.php?t=5120
http://www.webhaus.com.br/forum/viewtopic.php?t=5119
http://www.webhaus.com.br/forum/viewtopic.php?t=5118
http://www.webhaus.com.br/forum/viewtopic.php?t=5117
http://www.webhaus.com.br/forum/viewtopic.php?t=5116
http://www.webhaus.com.br/forum/viewtopic.php?t=5115
http://www.webhaus.com.br/forum/viewtopic.php?t=5114
http://www.webhaus.com.br/forum/viewtopic.php?t=5113
http://www.webhaus.com.br/forum/viewtopic.php?t=5112
http://www.webhaus.com.br/forum/viewtopic.php?t=5111
http://www.webhaus.com.br/forum/viewtopic.php?t=5110
http://www.webhaus.com.br/forum/viewtopic.php?t=5109
http://www.webhaus.com.br/forum/viewtopic.php?t=5108
http://www.webhaus.com.br/forum/viewtopic.php?t=5107
http://www.webhaus.com.br/forum/viewtopic.php?t=5106
http://www.webhaus.com.br/forum/viewtopic.php?t=5105
http://www.webhaus.com.br/forum/viewtopic.php?t=5104
http://www.webhaus.com.br/forum/viewtopic.php?t=5103
http://www.webhaus.com.br/forum/viewtopic.php?t=5102
http://www.webhaus.com.br/forum/viewtopic.php?t=5101
http://www.webhaus.com.br/forum/viewtopic.php?t=5100
http://www.webhaus.com.br/forum/viewtopic.php?t=5099
http://www.webhaus.com.br/forum/viewtopic.php?t=5098
http://www.webhaus.com.br/forum/viewtopic.php?t=5097
http://www.webhaus.com.br/forum/viewtopic.php?t=5096
http://www.webhaus.com.br/forum/viewtopic.php?t=5095
http://www.webhaus.com.br/forum/viewtopic.php?t=5093
http://www.webhaus.com.br/forum/viewtopic.php?t=5092
http://www.webhaus.com.br/forum/viewtopic.php?t=5087
http://www.webhaus.com.br/forum/viewtopic.php?t=5086
http://www.webhaus.com.br/forum/viewtopic.php?t=5085
http://www.webhaus.com.br/forum/viewtopic.php?t=5084
http://www.webhaus.com.br/forum/viewtopic.php?t=5083
http://www.webhaus.com.br/forum/viewtopic.php?t=5082
http://www.webhaus.com.br/forum/viewtopic.php?t=5081
http://www.webhaus.com.br/forum/viewtopic.php?t=5079
http://www.webhaus.com.br/forum/viewtopic.php?t=5078
http://www.webhaus.com.br/forum/viewtopic.php?t=5077
http://www.webhaus.com.br/forum/viewtopic.php?t=5076
http://www.webhaus.com.br/forum/viewtopic.php?t=5075
http://www.webhaus.com.br/forum/viewtopic.php?t=5074
http://www.webhaus.com.br/forum/viewtopic.php?t=5073
http://www.webhaus.com.br/forum/viewtopic.php?t=5072
http://www.webhaus.com.br/forum/viewtopic.php?t=5071
http://www.webhaus.com.br/forum/viewtopic.php?t=5070
http://www.webhaus.com.br/forum/viewtopic.php?t=5069
http://www.webhaus.com.br/forum/viewtopic.php?t=5068
http://www.webhaus.com.br/forum/viewtopic.php?t=5067
http://www.webhaus.com.br/forum/viewtopic.php?t=5066
http://www.webhaus.com.br/forum/viewtopic.php?t=5065
http://www.webhaus.com.br/forum/viewtopic.php?t=5064