You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@ofbiz.apache.org by "Lilian Iatco (JIRA)" <ji...@apache.org> on 2015/06/16 10:45:00 UTC
[jira] [Created] (OFBIZ-6506) XSS vulnerability in OFBiz forms and
screens especially in display-entity
Lilian Iatco created OFBIZ-6506:
-----------------------------------
Summary: XSS vulnerability in OFBiz forms and screens especially in display-entity
Key: OFBIZ-6506
URL: https://issues.apache.org/jira/browse/OFBIZ-6506
Project: OFBiz
Issue Type: Bug
Components: ALL COMPONENTS
Reporter: Lilian Iatco
In Ofbiz form need to escape characters from description column in a display-entity tag to avoid XSS attacks.
<display-entity entity-name="Table" description="${description}" >
I tried to use bsh, as following:
<display-entity entity-name="Table" description="${bsh: org.apache.commons.lang.StringEscapeUtils.escapeHtml("${description}")}">
But I get this error:
Error rendering screen [component://my/widget/CommonScreens.xml#GlobalDecorator]: java.lang.IllegalStateException: This object has been flagged as immutable (unchangeable), probably because it came from an Entity Engine cache. Cannot set a value in an immutable entity object.
(This object has been flagged as immutable (unchangeable), probably because it came from an Entity Engine cache. Cannot set a value in an immutable entity object.)
Also you can see here a similar issue:
http://stackoverflow.com/questions/30097370/how-to-escape-characters-in-ofbiz-widget
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)