You are viewing a plain text version of this content. The canonical link for it is here.

Posted to issues@activemq.apache.org by "Jean-Baptiste Onofré (Jira)" <ji...@apache.org> on 2019/11/08 13:41:00 UTC

[jira] [Assigned] (AMQ-7339) Fix possible XSS attack in the HttpTunnelServlet

     [ https://issues.apache.org/jira/browse/AMQ-7339?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Jean-Baptiste Onofré reassigned AMQ-7339:
-----------------------------------------

    Assignee: Jean-Baptiste Onofré

> Fix possible XSS attack in the HttpTunnelServlet
> ------------------------------------------------
>
>                 Key: AMQ-7339
>                 URL: https://issues.apache.org/jira/browse/AMQ-7339
>             Project: ActiveMQ
>          Issue Type: Improvement
>            Reporter: Colm O hEigeartaigh
>            Assignee: Jean-Baptiste Onofré
>            Priority: Major
>             Fix For: 5.16.0, 5.15.11
>
>          Time Spent: 10m
>  Remaining Estimate: 0h
>
> There is a potential XXS attack in the HttpTunnelServlet where we return the clientId header directly in an error. The fix is just to avoid sending the header back at all, as I didn't want to add an additional dependency to encode it.



--
This message was sent by Atlassian Jira
(v8.3.4#803005)