[jira] Closed: (WICKET-2907) CSRF vulnerability when enabling AutomaticMultiWindowSupport and using AJAX and BookmarkablePageLink features

["Igor Vaynberg (JIRA)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/WICKET-2907?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Igor Vaynberg closed WICKET-2907.
---------------------------------

      Assignee: Igor Vaynberg
    Resolution: Cannot Reproduce

i tried to reproduce it but could not

first of all the link that was supposed to cause it was broken, it used the xsstest context while the quickstart runs in root, even after fixing the link the output to the browser was like this:


<script type="text/javascript" ><!--/*--><![CDATA[/*><!--*/
if (window.name=='' || (window.name.indexOf('wicket') > -1 && window.name!='wicket-wicket:default')) { window.location="?wicket:bookmarkablePage=wicket-3:foo.OtherPage&?9a58d%22%3Balert%28'we+are+now+executing+arbitrary+JS+sent+in+a+link'%29%3B%7D//53796d16013=1" + (window.location.hash != null ? window.location.hash : ""); }
/*-->]]>*/</script>

so your javascript snippet failed to produce the quote ( " ) character in order to close wicket's javascript. i have tested in IE8, ffox, chrome, and none executed the javascript.

please reopen when you can provide a working testcase, cheers.

> CSRF vulnerability when enabling AutomaticMultiWindowSupport and using AJAX and BookmarkablePageLink features
> -------------------------------------------------------------------------------------------------------------
>
>                 Key: WICKET-2907
>                 URL: https://issues.apache.org/jira/browse/WICKET-2907
>             Project: Wicket
>          Issue Type: Bug
>          Components: wicket
>    Affects Versions: 1.4.9
>            Reporter: Joel Barciauskas
>            Assignee: Igor Vaynberg
>         Attachments: xsstest.zip
>
>
> When using the default URL coding strategy, along with automaticmultiwindowsupport set to true, any bookmarkablepagelink may be modified to enable injection of arbitrary javascript code.  

-- 
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.