You are viewing a plain text version of this content. The canonical link for it is here.

Posted to dev@deltaspike.apache.org by "Mark Struberg (JIRA)" <ji...@apache.org> on 2017/12/20 15:04:00 UTC

[jira] [Assigned] (DELTASPIKE-1307) Deltaspike JSF: XSS WindowIdHtmlRenderer.java

     [ https://issues.apache.org/jira/browse/DELTASPIKE-1307?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Mark Struberg reassigned DELTASPIKE-1307:
-----------------------------------------

    Assignee: Mark Struberg

> Deltaspike JSF: XSS WindowIdHtmlRenderer.java
> ---------------------------------------------
>
>                 Key: DELTASPIKE-1307
>                 URL: https://issues.apache.org/jira/browse/DELTASPIKE-1307
>             Project: DeltaSpike
>          Issue Type: Bug
>          Components: JSF-Module
>    Affects Versions: 1.8.0
>         Environment: any
>            Reporter: md
>            Assignee: Mark Struberg
>              Labels: security
>
> 10 chars ough to be enough for XSS.
> Try escaping your variables.
> https://github.com/apache/deltaspike/blob/master/deltaspike/modules/jsf/impl/src/main/java/org/apache/deltaspike/jsf/impl/component/window/WindowIdHtmlRenderer.java
> Line 80
> PoC
> dswid='-open()-'



--
This message was sent by Atlassian JIRA
(v6.4.14#64029)