[jira] [Updated] (OFBIZ-12254) XSS vulnerability for ListWorkEfforts form

["Xin Wang (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/OFBIZ-12254?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Xin Wang updated OFBIZ-12254:
-----------------------------
    Attachment: 0001-Fixed-Escaping-description-text-for-hyperlink-OFBIZ-.patch

> XSS vulnerability for ListWorkEfforts form
> ------------------------------------------
>
>                 Key: OFBIZ-12254
>                 URL: https://issues.apache.org/jira/browse/OFBIZ-12254
>             Project: OFBiz
>          Issue Type: Bug
>    Affects Versions: Trunk
>            Reporter: Xin Wang
>            Priority: Major
>         Attachments: 0001-Fixed-Escaping-description-text-for-hyperlink-OFBIZ-.patch
>
>
> If `sanitizer.enable` is turned off, `ListWorkEfforts` form will be vulnerable to XSS attack, because of incomplete escaping.
> Steps to reproduce:
> 1. Turn off `sanitizer.enable` in owasp.properties
> 2. Create a WorkEffort entity with name as `<script>alert(1)</script>`
> 3. Go to page: http://localhost:8080/workeffort/control/FindWorkEffort
> 4. Search for "Work Effort Name" which contains "script"



--
This message was sent by Atlassian Jira
(v8.3.4#803005)