[
https://issues.apache.org/jira/browse/OFBIZ-6506?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14626426#comment-14626426
]
Lilian Iatco edited comment on OFBIZ-6506 at 7/14/15 2:54 PM:
--------------------------------------------------------------
about first issue described here.. we have this case:
{code}<display-entity entity-name="Table" description="XSS from DB">{code}
If we submit this script: {code}<input type="image"
src="javascript:alert('XSS');">{code} as value for description column in DB and
after that we go on this form, got js alert.
Seems that it's not reproducible for this script:
{code}<script>alert('alert')</script>{code}
Exists here a way to escape chars in description attribute from component:
{code}<display-entity{code}
was (Author: administractor):
about first issue described here.. we have this case:
{code}<display-entity entity-name="Table" description="XSS from DB">{code}
If we submit this script: {code}<input type="image"
src="javascript:alert('XSS');">{code} as value for description column in DB and
after that we go on this form, got js alert.
Seems that it's not reproducible for this script:
{code}<script>alert('alert')</script>{code}
Exists here a way to escape chars in description attribute from
{code}<display-entity{code}
> XSS vulnerability in OFBiz forms and screens especially in display-entity
> component
> -----------------------------------------------------------------------------------
>
> Key: OFBIZ-6506
> URL: https://issues.apache.org/jira/browse/OFBIZ-6506
> Project: OFBiz
> Issue Type: Bug
> Components: ALL COMPONENTS
> Reporter: Lilian Iatco
> Assignee: Jacques Le Roux
> Labels: display, entity, form, ofbiz, screen, vulnerability, xss
> Attachments: Tooltip no XSS issue.png
>
>
> In Ofbiz form need to escape characters from description column in a
> display-entity tag to avoid XSS attacks.
> {code}<display-entity entity-name="Table" description="${description}" >{code}
> I tried to use bsh, as following:
> {code}<display-entity entity-name="Table" description="${bsh:
> org.apache.commons.lang.StringEscapeUtils.escapeHtml("${description}")}">{code}
> But I get this error:
> {code}
> Error rendering screen
> [component://my/widget/CommonScreens.xml#GlobalDecorator]:
> java.lang.IllegalStateException: This object has been flagged as immutable
> (unchangeable), probably because it came from an Entity Engine cache. Cannot
> set a value in an immutable entity object.
> (This object has been flagged as immutable (unchangeable), probably because
> it came from an Entity Engine cache. Cannot set a value in an immutable
> entity object.)
> {code}
> PS:
> Also you can see here a similar issue:
> http://stackoverflow.com/questions/30097370/how-to-escape-characters-in-ofbiz-widget
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
