ofbiz-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Jacques Le Roux (JIRA)" <j...@apache.org>
Subject [jira] [Closed] (OFBIZ-6506) XSS vulnerability in OFBiz forms and screens especially in display-entity component
Date Wed, 06 Apr 2016 10:46:25 GMT

     [ https://issues.apache.org/jira/browse/OFBIZ-6506?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]

Jacques Le Roux closed OFBIZ-6506.
----------------------------------
       Resolution: Fixed
    Fix Version/s: Release Branch 14.12
                   12.04.06
                   13.07.03
                   Release Branch 15.12
                   Upcoming Branch

> XSS vulnerability in OFBiz forms and screens especially in display-entity component
> -----------------------------------------------------------------------------------
>
>                 Key: OFBIZ-6506
>                 URL: https://issues.apache.org/jira/browse/OFBIZ-6506
>             Project: OFBiz
>          Issue Type: Sub-task
>          Components: ALL COMPONENTS
>            Reporter: Lilian Iatco
>            Assignee: Jacques Le Roux
>              Labels: display, entity, form, ofbiz, screen, vulnerability, xss
>             Fix For: Upcoming Branch, Release Branch 15.12, 13.07.03, 12.04.06, Release
Branch 14.12
>
>         Attachments: Tooltip no XSS issue.png
>
>
> In Ofbiz form need to escape characters from description column in a display-entity tag
to avoid XSS attacks.
> {code}<display-entity entity-name="Table" description="${description}" >{code}
> I tried to use bsh, as following:
> {code}<display-entity entity-name="Table" description="${bsh: org.apache.commons.lang.StringEscapeUtils.escapeHtml(&quot;${description}&quot;)}">{code}
> But I get this error:
> {code}
> Error rendering screen [component://my/widget/CommonScreens.xml#GlobalDecorator]: java.lang.IllegalStateException:
This object has been flagged as immutable (unchangeable), probably because it came from an
Entity Engine cache. Cannot set a value in an immutable entity object. 
> (This object has been flagged as immutable (unchangeable), probably because it came from
an Entity Engine cache. Cannot set a value in an immutable entity object.)
> {code}
> PS:
> Also you can see here a similar issue:
> http://stackoverflow.com/questions/30097370/how-to-escape-characters-in-ofbiz-widget



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)

Mime
View raw message