[
https://issues.apache.org/jira/browse/SLING-11768?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17685874#comment-17685874
]
Konrad Windszus edited comment on SLING-11768 at 2/8/23 11:59 AM:
------------------------------------------------------------------
As internally only {{XSSApi.encodeForJSString()}} is called in
https://github.com/apache/sling-org-apache-sling-scripting-sightly/blob/d677bfad1c040aaa439fa3be2d4828d37da4d5f5/src/main/java/org/apache/sling/scripting/sightly/impl/engine/extension/XSSRuntimeExtension.java#L127
this is probably an issue with the XSS library rather than with HTL.
There is even an explicit test for that hyphen encoding at
https://github.com/apache/sling-org-apache-sling-xss/blob/3e1ae6c63fad9fd37ba2fafc4d2dab05bc24ed44/src/test/java/org/apache/sling/xss/impl/XSSAPIImplTest.java#L609
but I fail to see how one can leverage a hyphen to break out of a JS string
context...
was (Author: kwin):
As internally only {{XSSApi.encodeForJSString()}} is called in
https://github.com/apache/sling-org-apache-sling-scripting-sightly/blob/d677bfad1c040aaa439fa3be2d4828d37da4d5f5/src/main/java/org/apache/sling/scripting/sightly/impl/engine/extension/XSSRuntimeExtension.java#L127
this is probably an issue with the XSS library rather than with HTL.
> Display Context "scriptString" encodes hyphen (-) as \u002D
> -----------------------------------------------------------
>
> Key: SLING-11768
> URL: https://issues.apache.org/jira/browse/SLING-11768
> Project: Sling
> Issue Type: Bug
> Components: HTL, XSS Protection API
> Reporter: Konrad Windszus
> Priority: Major
>
> According to
> https://github.com/adobe/htl-spec/blob/master/SPECIFICATION.md#121-display-context
> the context {{scriptString}} should only encode
> {quote}
> ... characters that would break out of the string.
> {quote}
> But {{AAA-BBB}} incorrectly becomes {{AAA\u002DBBB}} through this context
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
