[
https://issues.apache.org/jira/browse/WW-5830?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Lukasz Lenart updated WW-5830:
------------------------------
Fix Version/s: 7.5.0
> FreeMarker UI templates write event-handler attributes (onclick, onsubmit,
> ...) without HTML escaping
> ------------------------------------------------------------------------------------------------------
>
> Key: WW-5830
> URL: https://issues.apache.org/jira/browse/WW-5830
> Project: Struts 2
> Issue Type: Bug
> Components: Core
> Affects Versions: 6.12.0, 7.0.0, 7.3.0, 7.4.0
> Reporter: Gouri Sankar A
> Priority: Minor
> Fix For: 7.5.0
>
> Time Spent: 10m
> Remaining Estimate: 0h
>
> The simple, xhtml, css_xhtml and html5 templates write the values of
> event-handler attributes (on*, doubleOn*, doubleAccesskey, the form
> onsubmit/onreset and the xhtml tooltip onmouseover) inside <#outputformat
> 'JavaScript'>${...}</#outputformat>. With FreeMarker 2.3.35 that output
> format does not escape anything and also turns off the surrounding HTML
> auto-escape, so these values are written raw. Every other attribute, for
> example title, is escaped, and the javatemplates engine escapes onclick.
> Reproduction (main, against a running Struts Boot app): <@s.textfield
> name="f" onclick="%\{payload}" title="%\{payload}"/> with the payload x"
> autofocus onfocus="alert(1) renders, in all four themes:
> title="x" autofocus onfocus="alert(1)" onclick="x" autofocus
> onfocus="alert(1)"
> The title value stays inside its attribute; the onclick value closes the
> attribute and adds new ones.
> THREAT_MODEL 8.8 says a value a UI tag renders into an attribute is
> HTML-escaped "under every bundled theme and rendering engine", with
> exceptions only for escape/escapeHtmlBody and URL-valued attributes; section
> 9 says a value the application hands to a framework tag is covered by 8.8.
> Scope: HTML escaping closes the attribute breakout. It does not make request
> data safe inside JavaScript code or strings in a handler (a browser decodes
> ' before the script runs). No default framework path feeding request data
> to these attributes was found; exposure needs an application binding data
> into one, for example onclick="%\{#parameters.x}".
> Affected versions: the wrappers (14 in simple/scripting-events.ftl) are
> present in the 6.12.0, 7.0.0, 7.3.0 and 7.4.0 tags, by source inspection. The
> rendering was only reproduced on main. The wrappers date from the WW-4972
> work (3d20e8095, 35497649b).
> Fix: remove the outputformat wrappers on those attributes (8 templates).
> Behaviour change: handlers containing ' & < > or " change byte-for-byte
> (browser-equivalent); applications that hand-escaped quotes (for example
> ") to work around the raw output would be double-escaped. Suggested
> release note: "Event-handler attributes (onclick, onsubmit, ...) rendered by
> the bundled templates are now HTML-escaped; remove any manual pre-escaping of
> quotes in values passed to them."
> Tests: new EventHandlerEscapeTest (5 of its 6 tests fail without the template
> change); 17 existing fixtures updated (' becomes ').
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
