continuum-issues mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Brent N Atkinson (JIRA)" <j...@apache.org>
Subject [jira] [Closed] (CONTINUUM-1983) unescaped HTML in SCM Changes summary
Date Mon, 04 May 2015 12:55:06 GMT

     [ https://issues.apache.org/jira/browse/CONTINUUM-1983?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]

Brent N Atkinson closed CONTINUUM-1983.
---------------------------------------
    Resolution: Fixed
      Assignee: Brent N Atkinson

This has been addressed in 1.5. For details, see CONTINUUM-2763.

> unescaped HTML in SCM Changes summary
> -------------------------------------
>
>                 Key: CONTINUUM-1983
>                 URL: https://issues.apache.org/jira/browse/CONTINUUM-1983
>             Project: Continuum
>          Issue Type: Bug
>          Components: Web - UI
>    Affects Versions: 1.1, 1.3.3 (Beta)
>         Environment: Linux
>            Reporter: Reimer Prochnow
>            Assignee: Brent N Atkinson
>            Priority: Minor
>              Labels: backlog-to-cleanup
>
> If you write HTML in scm commit comments, this HTML is shown in the SCM changes summary
section on the build result page.
> It should be escaped for security issues.
> The page involved is:
> continuum-webapp\src\main\webapp\WEB-INF\jsp\buildresult.jsp, Line 61
> <ec:column property="comment" title="buildResult.changes.comment" />
> But the columns are rendered by extremecomponents taglib.
> This should be able to escape HTML by configuration, unfortunately i do not find any
documentation on this taglib



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)

Mime
View raw message