You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@struts.apache.org by "lukaszlenart (via GitHub)" <gi...@apache.org> on 2026/05/20 06:52:50 UTC

[PR] WW-5623 fix(core): HTML-encode form action in PostbackResult to prevent XSS [struts]

lukaszlenart opened a new pull request, #1701:
URL: https://github.com/apache/struts/pull/1701

   Backports #1653 to the 6.x line.
   
   `PostbackResult.doExecute()` embeds `finalLocation` into a `<form action="">` attribute via raw string concatenation. Wrap it with `StringEscapeUtils.escapeHtml4()`, consistent with the encoding approach used in `DefaultActionProxy`, `Property`, and `TextProviderHelper`.
   
   See [#1653](https://github.com/apache/struts/pull/1653) for the full analysis.
   
   Adds three regression tests covering the XSS payload, all special characters, and the clean-URL regression case.
   
   Fixes [WW-5623](https://issues.apache.org/jira/browse/WW-5623).


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@struts.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] WW-5623 fix(core): HTML-encode form action in PostbackResult to prevent XSS [struts]

Posted by "lukaszlenart (via GitHub)" <gi...@apache.org>.
lukaszlenart merged PR #1701:
URL: https://github.com/apache/struts/pull/1701


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@struts.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] WW-5623 fix(core): HTML-encode form action in PostbackResult to prevent XSS [struts]

Posted by "lukaszlenart (via GitHub)" <gi...@apache.org>.
lukaszlenart commented on PR #1701:
URL: https://github.com/apache/struts/pull/1701#issuecomment-4599594451

   ## Just one important remark
   
   This PR doesn't address a vulnerability, it's pure framework hardening. The potential attack vector assumes a developer uses a raw user input in OGNL expression evaluation which is against our guideline:
   https://struts.apache.org/security/#do-not-use-incoming-untrusted-user-input-in-forced-expression-evaluation


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@struts.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] WW-5623 fix(core): HTML-encode form action in PostbackResult to prevent XSS [struts]

Posted by "sonarqubecloud[bot] (via GitHub)" <gi...@apache.org>.
sonarqubecloud[bot] commented on PR #1701:
URL: https://github.com/apache/struts/pull/1701#issuecomment-4495495190

   ## [![Quality Gate Passed](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/QualityGateBadge/qg-passed-20px.png 'Quality Gate Passed')](https://sonarcloud.io/dashboard?id=apache_struts&pullRequest=1701) **Quality Gate passed**  
   Issues  
   ![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [13 New issues](https://sonarcloud.io/project/issues?id=apache_struts&pullRequest=1701&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)  
   ![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/accepted-16px.png '') [0 Accepted issues](https://sonarcloud.io/project/issues?id=apache_struts&pullRequest=1701&issueStatuses=ACCEPTED)
   
   Measures  
   ![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=apache_struts&pullRequest=1701&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)  
   ![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [100.0% Coverage on New Code](https://sonarcloud.io/component_measures?id=apache_struts&pullRequest=1701&metric=new_coverage&view=list)  
   ![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [0.0% Duplication on New Code](https://sonarcloud.io/component_measures?id=apache_struts&pullRequest=1701&metric=new_duplicated_lines_density&view=list)  
     
   <!-- sqra-placement-anchor -->
   [See analysis details on SonarQube Cloud](https://sonarcloud.io/dashboard?id=apache_struts&pullRequest=1701)
   
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@struts.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org