[
https://issues.apache.org/jira/browse/OFBIZ-6506?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14620196#comment-14620196
]
Lilian Iatco edited comment on OFBIZ-6506 at 7/9/15 9:49 AM:
-------------------------------------------------------------
http://stackoverflow.com/questions/30097370/how-to-escape-characters-in-ofbiz-widget
it reproduces for this case:
put in URL parameter HTML code:
{code}https://host:8403/xxx/yyy/Product?productId=<font
color=red>XSS</font>{code}
The value is set in PScreens.xml as following :
{code}
<screen name="Product">
<section>
<actions>
<set field="productId" from-field="parameters.productId"/>
</actions>
<widgets>
<include-form name="Product" location="component://.../xxx/yyy/PForms.xml"/>
</widgets>
{code}
The value to escape is productId from tooltip attribute:
{code}<field name="productId" tooltip="${uiLabelMap.ProductId}
[${productId}]"><text size="20" maxlength="20"/></field>{code}
Can you also suggest a solution for this issue:
http://stackoverflow.com/questions/30708500/how-to-escape-characters-in-ofbiz-display-entity-xss-in-ofbiz
Thank You
was (Author: administractor):
http://stackoverflow.com/questions/30097370/how-to-escape-characters-in-ofbiz-widget
it reproduces for this case:
put in URL parameter HTML code:
[code]https://host:8403/xxx/yyy/Product?productId=<font
color=red>XSS</font>[/code]
The value is set in PScreens.xml as following :
[code]
<screen name="Product">
<section>
<actions>
<set field="productId" from-field="parameters.productId"/>
</actions>
<widgets>
<include-form name="Product" location="component://.../xxx/yyy/PForms.xml"/>
</widgets>
[/code]
The value to escape is productId from tooltip attribute:
[code]<field name="productId" tooltip="${uiLabelMap.ProductId}
[${productId}]"><text size="20" maxlength="20"/></field>[/code]
Can you also suggest a solution for this issue:
http://stackoverflow.com/questions/30708500/how-to-escape-characters-in-ofbiz-display-entity-xss-in-ofbiz
> XSS vulnerability in OFBiz forms and screens especially in display-entity
> component
> -----------------------------------------------------------------------------------
>
> Key: OFBIZ-6506
> URL: https://issues.apache.org/jira/browse/OFBIZ-6506
> Project: OFBiz
> Issue Type: Bug
> Components: ALL COMPONENTS
> Reporter: Lilian Iatco
> Labels: display, entity, form, ofbiz, screen, vulnerability, xss
>
> In Ofbiz form need to escape characters from description column in a
> display-entity tag to avoid XSS attacks.
> <display-entity entity-name="Table" description="${description}" >
> I tried to use bsh, as following:
> <display-entity entity-name="Table" description="${bsh:
> org.apache.commons.lang.StringEscapeUtils.escapeHtml("${description}")}">
> But I get this error:
> Error rendering screen
> [component://my/widget/CommonScreens.xml#GlobalDecorator]:
> java.lang.IllegalStateException: This object has been flagged as immutable
> (unchangeable), probably because it came from an Entity Engine cache. Cannot
> set a value in an immutable entity object.
> (This object has been flagged as immutable (unchangeable), probably because
> it came from an Entity Engine cache. Cannot set a value in an immutable
> entity object.)
> Also you can see here a similar issue:
> http://stackoverflow.com/questions/30097370/how-to-escape-characters-in-ofbiz-widget
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
