arturobernalg commented on PR #323:
URL: https://github.com/apache/jspwiki/pull/323#issuecomment-6341404297
Hi @spyhunter99, sorry for the long delay, and thanks for the nudge. I
rebased this PR on the current master and reworked it, so it is ready for
another look.
Instead of sanitizing the values when they are stored, which would also
rewrite the directory paths (a "/" would become an entity) and was what made
the old tests hard to update, the values are now escaped where Install.jsp
writes them to the page: the application name, the page and work directories,
the properties path and the list of validated properties. The stored values are
left untouched.
I checked it on Tomcat with the payload from the issue
('"><script>alert(1)</script> as application name and page directory). With
master the script tag is rendered raw in the form fields and in the properties
list; with this change it comes out escaped. Install.jsp has no unit tests, so
this was verified against the running webapp.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
