You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@struts.apache.org by "tranquac (via GitHub)" <gi...@apache.org> on 2026/04/06 15:19:05 UTC
[PR] fix(core): HTML-encode form action in PostbackResult to prevent XSS [struts]
tranquac opened a new pull request, #1653:
URL: https://github.com/apache/struts/pull/1653
## Summary
PostbackResult.doExecute() at line 107 embeds finalLocation into a form action attribute via raw string concatenation without HTML encoding. The response Content-Type is text/html (line 103). A double-quote character in the location breaks out of the attribute, enabling reflected XSS.
This is an encoding inconsistency: form field names and values at lines 218-219 ARE properly URL-encoded via URLEncoder.encode(), but the form action attribute was not encoded at all.
## Changes
- **PostbackResult.java**: Add encodeHtml() method to escape &, ", <, > in finalLocation before embedding in the HTML form tag. Consistent with the existing encoding approach for form field values.
## Impact
When a developer uses PostbackResult with an OGNL expression referencing a user-controllable property (a documented framework feature for dynamic routing), an attacker can inject arbitrary HTML attributes and elements via the form action attribute.
## Test
A PoC application with 5 test scenarios verifies the vulnerability and fix. Browser-based testing with Playwright confirms the XSS alert fires before the fix.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@struts.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix(core): WW-5623 HTML-encode form action in PostbackResult to prevent XSS [struts]
Posted by "lukaszlenart (via GitHub)" <gi...@apache.org>.
lukaszlenart merged PR #1653:
URL: https://github.com/apache/struts/pull/1653
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@struts.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix(core): WW-5623 HTML-encode form action in PostbackResult to prevent XSS [struts]
Posted by "lukaszlenart (via GitHub)" <gi...@apache.org>.
lukaszlenart commented on PR #1653:
URL: https://github.com/apache/struts/pull/1653#issuecomment-4599593594
## Just one important remark
This PR doesn't address a vulnerability, it's pure framework hardening. The potential attack vector assumes a developer uses a raw user input in OGNL expression evaluation which is against our guideline:
https://struts.apache.org/security/#do-not-use-incoming-untrusted-user-input-in-forced-expression-evaluation
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@struts.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix(core): HTML-encode form action in PostbackResult to prevent XSS [struts]
Posted by "tranquac (via GitHub)" <gi...@apache.org>.
tranquac commented on PR #1653:
URL: https://github.com/apache/struts/pull/1653#issuecomment-4203987203
hello @lukaszlenart
I created JIRA ticket for this issue: https://issues.apache.org/jira/projects/WW/issues/WW-5623?filter=allissues
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@struts.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix(core): HTML-encode form action in PostbackResult to prevent XSS [struts]
Posted by "lukaszlenart (via GitHub)" <gi...@apache.org>.
lukaszlenart commented on PR #1653:
URL: https://github.com/apache/struts/pull/1653#issuecomment-4200999489
Could you create a JIRA ticket first?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@struts.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix(core): WW-5623 HTML-encode form action in PostbackResult to prevent XSS [struts]
Posted by "tranquac (via GitHub)" <gi...@apache.org>.
tranquac commented on PR #1653:
URL: https://github.com/apache/struts/pull/1653#issuecomment-4235088125
If there are any further issues that need correction or addition, let me know so I can improve it. Thanks @lukaszlenart and reviewers!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@struts.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix(core): WW-5623 HTML-encode form action in PostbackResult to prevent XSS [struts]
Posted by "tranquac (via GitHub)" <gi...@apache.org>.
tranquac commented on PR #1653:
URL: https://github.com/apache/struts/pull/1653#issuecomment-4205211031
Thanks for your feedback. I will quickly create a fullfill patch based on your comment. I will notify you when it's finished and create a new PR.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@struts.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix(core): HTML-encode form action in PostbackResult to prevent XSS [struts]
Posted by "tranquac (via GitHub)" <gi...@apache.org>.
tranquac commented on PR #1653:
URL: https://github.com/apache/struts/pull/1653#issuecomment-4203866509
I requested a Jira account!
And i will create create a JIRA ticket soon!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@struts.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix(core): WW-5623 HTML-encode form action in PostbackResult to prevent XSS [struts]
Posted by "lukaszlenart (via GitHub)" <gi...@apache.org>.
lukaszlenart commented on PR #1653:
URL: https://github.com/apache/struts/pull/1653#issuecomment-4205171361
Please add a focused unit test for this change in `PostbackResultTest`, covering a malicious `finalLocation` with characters like `"`, `&`, `<`, and `>` and asserting they are properly escaped in the rendered `action` attribute. The fix looks correct for WW-5623, but it should include regression coverage. Also, for consistency with the rest of Struts core, you may want to use `StringEscapeUtils.escapeHtml4(...)` instead of a custom `encodeHtml()` helper.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@struts.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix(core): HTML-encode form action in PostbackResult to prevent XSS [struts]
Posted by "tranquac (via GitHub)" <gi...@apache.org>.
tranquac commented on PR #1653:
URL: https://github.com/apache/struts/pull/1653#issuecomment-4201128787
How can I create @lukaszlenart ?
I have submitted this patch to: https://bughunters.google.com/open-source-security/patch-rewards
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@struts.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix(core): HTML-encode form action in PostbackResult to prevent XSS [struts]
Posted by "tranquac (via GitHub)" <gi...@apache.org>.
tranquac commented on PR #1653:
URL: https://github.com/apache/struts/pull/1653#issuecomment-4203270716
hi @lukaszlenart
How can I create a JIRA ticket?
have a good day!
Quac Tran
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@struts.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix(core): WW-5623 HTML-encode form action in PostbackResult to prevent XSS [struts]
Posted by "tranquac (via GitHub)" <gi...@apache.org>.
tranquac commented on PR #1653:
URL: https://github.com/apache/struts/pull/1653#issuecomment-4210561215
Hi @lukaszlenart,
Thank you for the review feedback! I've pushed a follow-up commit addressing both points:
### Changes in this update
**1. Replaced custom `encodeHtml()` with `StringEscapeUtils.escapeHtml4()`**
Removed the custom helper method and switched to `org.apache.commons.text.StringEscapeUtils.escapeHtml4()`, consistent with how the rest of Struts core handles HTML encoding (e.g., `DefaultActionProxy`, `Property`, `TextProviderHelper`).
**2. Added 3 focused unit tests in `PostbackResultTest`**
| Test | What it covers |
|---|---|
| `testFormActionHtmlEscaping` | XSS payload with double-quote attribute breakout (`"onmouseover="alert(1)"`). Asserts escaped entities in rendered action attribute and verifies raw `"` cannot break out. |
| `testFormActionEscapesAllHtmlSpecialChars` | Covers all 4 critical HTML characters (`"`, `&`, `<`, `>`) individually, asserting each is properly escaped to its HTML entity (`"`, `&`, `<`, `>`). |
| `testFormActionCleanLocationUnchanged` | Regression test — verifies that a clean URL without special characters renders unchanged in the action attribute. |
All 7 tests pass (4 existing + 3 new):
```
Tests run: 7, Failures: 0, Errors: 0, Skipped: 0
BUILD SUCCESS
```
Please let me know if there's anything else you'd like me to adjust.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@struts.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix(core): HTML-encode form action in PostbackResult to prevent XSS [struts]
Posted by "github-advanced-security[bot] (via GitHub)" <gi...@apache.org>.
github-advanced-security[bot] commented on code in PR #1653:
URL: https://github.com/apache/struts/pull/1653#discussion_r3040404799
##########
core/src/main/java/org/apache/struts2/result/PostbackResult.java:
##########
@@ -104,7 +104,8 @@
// Render
PrintWriter pw = new PrintWriter(response.getOutputStream());
- pw.write("<!DOCTYPE html><html><body><form action=\"" + finalLocation + "\" method=\"POST\">");
+ String safeLocation = encodeHtml(finalLocation);
+ pw.write("<!DOCTYPE html><html><body><form action=\"" + safeLocation + "\" method=\"POST\">");
Review Comment:
## CodeQL / Information exposure through an error message
[Error information](1) can be exposed to an external user.
[Error information](2) can be exposed to an external user.
[Show more details](https://github.com/apache/struts/security/code-scanning/1309)
##########
core/src/main/java/org/apache/struts2/result/PostbackResult.java:
##########
@@ -104,7 +104,8 @@
// Render
PrintWriter pw = new PrintWriter(response.getOutputStream());
- pw.write("<!DOCTYPE html><html><body><form action=\"" + finalLocation + "\" method=\"POST\">");
+ String safeLocation = encodeHtml(finalLocation);
+ pw.write("<!DOCTYPE html><html><body><form action=\"" + safeLocation + "\" method=\"POST\">");
Review Comment:
## CodeQL / Cross-site scripting
Cross-site scripting vulnerability due to a [user-provided value](1).
[Show more details](https://github.com/apache/struts/security/code-scanning/1310)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@struts.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix(core): WW-5623 HTML-encode form action in PostbackResult to prevent XSS [struts]
Posted by "tranquac (via GitHub)" <gi...@apache.org>.
tranquac commented on PR #1653:
URL: https://github.com/apache/struts/pull/1653#issuecomment-4334204443
Hi @jogep, @aleksandr-m, @yasserzamani, @sdutry, @cnenning, @kusalk
Could you pls help me check this PR?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@struts.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org