[GitHub] [cloudstack] BryanMLima commented on pull request #6692: Remove unnecessary escape method

[GitBox <gi...@apache.org>]

BryanMLima commented on PR #6692:
URL: https://github.com/apache/cloudstack/pull/6692#issuecomment-1278158364

   Hi @DaanHoogland, sorry for the delay, the method did not make any sense as it was only for JS strings; it did not prevent any XSS attacks.  
     
   As for the XSS attack @rohityadavcloud, I investigated this concern, and tested a lot of scenarios using OWASP [Cheatsheet](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html) as reference. Displaying the contents of the email template on the UI with malicious code did not result in any problems, as it is inside a component. However, with further investigation, there is a lack of validation upon creating domains and accounts regarding their names. Creating a domain with the name `<h1>test</h1>` and using the `${domainName}` inside the email template would result in the email client rendering that HTML tag. I tested with a simple `script` tag; however, most email clients already filter these tags, and therefore, it was totally omitted from the email.
   
   In this case, to resolve this problem I escaped the possible HTML in the domain and account names variables to prevent any issues. Finally, it may be interesting to investigate the validation on account and domain names to block users from using any HTML tags and prevent any future problems.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org