[magnolia-dev] [JIRA] (JSMODELS-8) JavascriptObjectFactory should expose HTMLEscapingAggregationState to templates

2017-06-20 Thread JIRA (on behalf of Federico Grilli) 
Title: Message Title


 
 
 
 

 
 
 

 
   
 Federico Grilli updated an issue  
 

  
 
 
 
 

 
 
  
 
 
 
 

 
 Magnolia _javascript_ Models /  JSMODELS-8  
 
 
  _javascript_ObjectFactory should expose HTMLEscapingAggregationState to templates   
 

  
 
 
 
 

 
Change By: 
 Federico Grilli  
 

  
 
 
 
 

 
 See relate issue MAGNOLIA-6448. Basically templates may get a vulnerable aggregation state object. To reproduce:- In Resources App create {{/travel-demo/models/components/textImage.js}}-- Add the following snippet to the above file{code}var MyModel = function() {this.currentURI= function() {return " state current uri  is " + state.currentURI;};};new MyModel();{code}- Edit {{/travel-demo/templates/components/textImage.yaml}} and add the following snippet{code}modelPath: /travel-demo/models/components/textImage.jsclass: info.magnolia.module.jsmodels.rendering._javascript_TemplateDefinition{code}- Edit {{/travel-demo/templates/components/textImage.ftl}} and add the following snippet{code}TEST ${model.currentURI()}{code}- open page with malicious URI http://localhost:8080/travel/about~cf503%22%3E%3Cimg%20src%3da%20onerror%3dalert(1)%3E7af3b~- problem shows up- enable {{/server/rendering/engine@escapeHtml=true}} and open again the above page  
 

  
 
 
 
 

 
 
 

 
 
 Add Comment  
 

  
 

  
 
 
 
  
 

  
 
 
 
 

 
 This message was sent by Atlassian JIRA (v7.2.6#72008-sha1:26175bf)

[magnolia-dev] [JIRA] (JSMODELS-8) JavascriptObjectFactory should expose HTMLEscapingAggregationState to templates

2017-06-20 Thread JIRA (on behalf of Federico Grilli) 
Title: Message Title


 
 
 
 

 
 
 

 
   
 Federico Grilli updated an issue  
 

  
 
 
 
 

 
 
  
 
 
 
 

 
 Magnolia _javascript_ Models /  JSMODELS-8  
 
 
  _javascript_ObjectFactory should expose HTMLEscapingAggregationState to templates   
 

  
 
 
 
 

 
Change By: 
 Federico Grilli  
 

  
 
 
 
 

 
 See relate issue MAGNOLIA-6448. Basically templates may get a vulnerable aggregation state object. To reproduce:- In Resources App create {{/travel-demo/models/components/textImage.js}}- - Add the following snippet to the above file{code}var MyModel = function() {this.currentURI= function() {return "state is " + state.currentURI;};};new MyModel();{code}-  Edit {{/travel-demo/templates/components/textImage.yaml}} and add the following snippet{code}modelPath: /travel-demo/models/components/textImage.jsclass: info.magnolia.module.jsmodels.rendering._javascript_TemplateDefinition{code}- Edit {{/travel-demo/templates/components/textImage.ftl}} and add the following snippet{code}TEST ${model.currentURI()}{code}- open page with malicious URI http://localhost:8080/travel/about~cf503%22%3E%3Cimg%20src%3da%20onerror%3dalert(1)%3E7af3b~- problem shows up- enable {{/server/rendering/engine@escapeHtml=true}} and open again the above page  
 

  
 
 
 
 

 
 
 

 
 
 Add Comment  
 

  
 

  
 
 
 
  
 

  
 
 
 
 

 
 This message was sent by Atlassian JIRA (v7.2.6#72008-sha1:26175bf)

[magnolia-dev] [JIRA] (JSMODELS-8) JavascriptObjectFactory should expose HTMLEscapingAggregationState to templates

2017-06-20 Thread JIRA (on behalf of Federico Grilli) 
Title: Message Title


 
 
 
 

 
 
 

 
   
 Federico Grilli updated an issue  
 

  
 
 
 
 

 
 
  
 
 
 
 

 
 Magnolia _javascript_ Models /  JSMODELS-8  
 
 
  _javascript_ObjectFactory should expose HTMLEscapingAggregationState to templates   
 

  
 
 
 
 

 
Change By: 
 Federico Grilli  
 
 
Fix Version/s: 
 1.0  
 

  
 
 
 
 

 
 
 

 
 
 Add Comment  
 

  
 

  
 
 
 
  
 

  
 
 
 
 

 
 This message was sent by Atlassian JIRA (v7.2.6#72008-sha1:26175bf)  
 
 

 
   
 

  
 

  
 

   




For list details, see: http://www.magnolia-cms.com/community/mailing-lists.html
Alternatively, use our forums: http://forum.magnolia-cms.com/
To unsubscribe, E-mail to: 

[magnolia-dev] [JIRA] (JSMODELS-8) JavascriptObjectFactory should expose HTMLEscapingAggregationState to templates

2017-06-20 Thread JIRA (on behalf of Federico Grilli) 
Title: Message Title


 
 
 
 

 
 
 

 
   
 Federico Grilli updated an issue  
 

  
 
 
 
 

 
 
  
 
 
 
 

 
 Magnolia _javascript_ Models /  JSMODELS-8  
 
 
  _javascript_ObjectFactory should expose HTMLEscapingAggregationState to templates   
 

  
 
 
 
 

 
Change By: 
 Federico Grilli  
 

  
 
 
 
 

 
 See relate issue MAGNOLIA-6448. Basically templates may get a vulnerable aggregation state object.  This needs further verification anyway  To reproduce:- In Resources App create {{/travel-demo/models/components/textImage . js}}  - Edit {{/travel-demo/templates/components/textImage.yaml}} and add the following snippet{code}modelPath: /travel-demo/models/components/textImage.jsclass: info.magnolia.module.jsmodels.rendering._javascript_TemplateDefinition{code}- Edit {{/travel-demo/templates/components/textImage.ftl}} and add the following snippet{code}TEST ${model.currentURI()}{code}- open page with malicious URI http://localhost:8080/travel/about~cf503%22%3E%3Cimg%20src%3da%20onerror%3dalert(1)%3E7af3b~- problem shows up- enable {{/server/rendering/engine@escapeHtml=true}} and open again the above page  
 

  
 
 
 
 

 
 
 

 
 
 Add Comment  
 

  
 

  
 
 
 
  
 

  
 
 
 
 

 
 This message was sent by Atlassian JIRA (v7.2.6#72008-sha1:26175bf)

[magnolia-dev] [JIRA] (JSMODELS-8) JavascriptObjectFactory should expose HTMLEscapingAggregationState to templates

2017-06-19 Thread JIRA (on behalf of Federico Grilli) 
Title: Message Title


 
 
 
 

 
 
 

 
   
 Federico Grilli updated an issue  
 

  
 
 
 
 

 
 
  
 
 
 
 

 
 Magnolia _javascript_ Models /  JSMODELS-8  
 
 
  _javascript_ObjectFactory should expose HTMLEscapingAggregationState to templates   
 

  
 
 
 
 

 
Change By: 
 Federico Grilli  
 
 
Assignee: 
 Federico Grilli  
 

  
 
 
 
 

 
 
 

 
 
 Add Comment  
 

  
 

  
 
 
 
  
 

  
 
 
 
 

 
 This message was sent by Atlassian JIRA (v7.2.6#72008-sha1:26175bf)  
 
 

 
   
 

  
 

  
 

   




For list details, see: http://www.magnolia-cms.com/community/mailing-lists.html
Alternatively, use our forums: http://forum.magnolia-cms.com/
To unsubscribe, E-mail to: 

[magnolia-dev] [JIRA] (JSMODELS-8) JavascriptObjectFactory should expose HTMLEscapingAggregationState to templates

2017-06-19 Thread JIRA (on behalf of Ilgun Ilgun) 
Title: Message Title


 
 
 
 

 
 
 

 
   
 Ilgun Ilgun updated an issue  
 

  
 
 
 
 

 
 
  
 
 
 
 

 
 Magnolia _javascript_ Models /  JSMODELS-8  
 
 
  _javascript_ObjectFactory should expose HTMLEscapingAggregationState to templates   
 

  
 
 
 
 

 
Change By: 
 Ilgun Ilgun  
 
 
Sprint: 
 Basel 101  
 

  
 
 
 
 

 
 
 

 
 
 Add Comment  
 

  
 

  
 
 
 
  
 

  
 
 
 
 

 
 This message was sent by Atlassian JIRA (v7.2.6#72008-sha1:26175bf)  
 
 

 
   
 

  
 

  
 

   




For list details, see: http://www.magnolia-cms.com/community/mailing-lists.html
Alternatively, use our forums: http://forum.magnolia-cms.com/
To unsubscribe, E-mail to: 

[magnolia-dev] [JIRA] (JSMODELS-8) JavascriptObjectFactory should expose HTMLEscapingAggregationState to templates

2017-06-12 Thread on behalf of Michael Mühlebach 
Title: Message Title


 
 
 
 

 
 
 

 
   
 Michael Mühlebach updated an issue  
 

  
 
 
 
 

 
 
  
 
 
 
 

 
 Magnolia _javascript_ Models /  JSMODELS-8  
 
 
  _javascript_ObjectFactory should expose HTMLEscapingAggregationState to templates   
 

  
 
 
 
 

 
Change By: 
 Michael Mühlebach  
 
 
Sprint: 
 Basel 100  
 

  
 
 
 
 

 
 
 

 
 
 Add Comment  
 

  
 

  
 
 
 
  
 

  
 
 
 
 

 
 This message was sent by Atlassian JIRA (v7.2.6#72008-sha1:26175bf)  
 
 

 
   
 

  
 

  
 

   




For list details, see: http://www.magnolia-cms.com/community/mailing-lists.html
Alternatively, use our forums: http://forum.magnolia-cms.com/
To unsubscribe, E-mail to: 

[magnolia-dev] [JIRA] (JSMODELS-8) JavascriptObjectFactory should expose HTMLEscapingAggregationState to templates

2017-06-12 Thread on behalf of Michael Mühlebach 
Title: Message Title


 
 
 
 

 
 
 

 
   
 Michael Mühlebach updated an issue  
 

  
 
 
 
 

 
 
  
 
 
 
 

 
 Magnolia _javascript_ Models /  JSMODELS-8  
 
 
  _javascript_ObjectFactory should expose HTMLEscapingAggregationState to templates   
 

  
 
 
 
 

 
Change By: 
 Michael Mühlebach  
 
 
Story Points: 
 3  
 

  
 
 
 
 

 
 
 

 
 
 Add Comment  
 

  
 

  
 
 
 
  
 

  
 
 
 
 

 
 This message was sent by Atlassian JIRA (v7.2.6#72008-sha1:26175bf)  
 
 

 
   
 

  
 

  
 

   




For list details, see: http://www.magnolia-cms.com/community/mailing-lists.html
Alternatively, use our forums: http://forum.magnolia-cms.com/
To unsubscribe, E-mail to: 

[magnolia-dev] [JIRA] (JSMODELS-8) JavascriptObjectFactory should expose HTMLEscapingAggregationState to templates

2017-06-08 Thread on behalf of Michael Mühlebach 
Title: Message Title


 
 
 
 

 
 
 

 
   
 Michael Mühlebach updated an issue  
 

  
 
 
 
 

 
 
  
 
 
 
 

 
 Magnolia _javascript_ Models /  JSMODELS-8  
 
 
  _javascript_ObjectFactory should expose HTMLEscapingAggregationState to templates   
 

  
 
 
 
 

 
Change By: 
 Michael Mühlebach  
 
 
Sprint: 
 Basel 100  
 

  
 
 
 
 

 
 
 

 
 
 Add Comment  
 

  
 

  
 
 
 
  
 

  
 
 
 
 

 
 This message was sent by Atlassian JIRA (v7.2.6#72008-sha1:26175bf)  
 
 

 
   
 

  
 

  
 

   




For list details, see: http://www.magnolia-cms.com/community/mailing-lists.html
Alternatively, use our forums: http://forum.magnolia-cms.com/
To unsubscribe, E-mail to: 

[magnolia-dev] [JIRA] (JSMODELS-8) JavascriptObjectFactory should expose HTMLEscapingAggregationState to templates

2017-06-08 Thread on behalf of Michael Mühlebach 
Title: Message Title


 
 
 
 

 
 
 

 
   
 Michael Mühlebach updated an issue  
 

  
 
 
 
 

 
 
  
 
 
 
 

 
 Magnolia _javascript_ Models /  JSMODELS-8  
 
 
  _javascript_ObjectFactory should expose HTMLEscapingAggregationState to templates   
 

  
 
 
 
 

 
Change By: 
 Michael Mühlebach  
 
 
Labels: 
 to-verify  
 

  
 
 
 
 

 
 
 

 
 
 Add Comment  
 

  
 

  
 
 
 
  
 

  
 
 
 
 

 
 This message was sent by Atlassian JIRA (v7.2.6#72008-sha1:26175bf)  
 
 

 
   
 

  
 

  
 

   




For list details, see: http://www.magnolia-cms.com/community/mailing-lists.html
Alternatively, use our forums: http://forum.magnolia-cms.com/
To unsubscribe, E-mail to: 

[magnolia-dev] [JIRA] (JSMODELS-8) JavascriptObjectFactory should expose HTMLEscapingAggregationState to templates

2017-06-02 Thread JIRA (on behalf of Federico Grilli) 
Title: Message Title


 
 
 
 

 
 
 

 
   
 Federico Grilli updated an issue  
 

  
 
 
 
 

 
 
  
 
 
 
 

 
 Magnolia _javascript_ Models /  JSMODELS-8  
 
 
  _javascript_ObjectFactory should expose HTMLEscapingAggregationState to templates   
 

  
 
 
 
 

 
Change By: 
 Federico Grilli  
 

  
 
 
 
 

 
 See relate issue MAGNOLIA-6448 . Basically templates may get a vulnerable aggregation state object. This needs further verification anyway.   
 

  
 
 
 
 

 
 
 

 
 
 Add Comment  
 

  
 

  
 
 
 
  
 

  
 
 
 
 

 
 This message was sent by Atlassian JIRA (v7.2.6#72008-sha1:26175bf)  
 
 

 
   
 

  
 

  
 

   




For list details, see: http://www.magnolia-cms.com/community/mailing-lists.html
Alternatively, use our forums: http://forum.magnolia-cms.com/
To unsubscribe, E-mail to: 

[magnolia-dev] [JIRA] (JSMODELS-8) JavascriptObjectFactory should expose HTMLEscapingAggregationState to templates

2017-06-02 Thread JIRA (on behalf of Federico Grilli) 
Title: Message Title


 
 
 
 

 
 
 

 
   
 Federico Grilli updated an issue  
 

  
 
 
 
 

 
 
  
 
 
 
 

 
 Magnolia _javascript_ Models /  JSMODELS-8  
 
 
  _javascript_ObjectFactory should expose HTMLEscapingAggregationState to templates   
 

  
 
 
 
 

 
Change By: 
 Federico Grilli  
 
 
Labels: 
 to-verify  
 

  
 
 
 
 

 
 
 

 
 
 Add Comment  
 

  
 

  
 
 
 
  
 

  
 
 
 
 

 
 This message was sent by Atlassian JIRA (v7.2.6#72008-sha1:26175bf)  
 
 

 
   
 

  
 

  
 

   




For list details, see: http://www.magnolia-cms.com/community/mailing-lists.html
Alternatively, use our forums: http://forum.magnolia-cms.com/
To unsubscribe, E-mail to: 

[magnolia-dev] [JIRA] (JSMODELS-8) JavascriptObjectFactory should expose HTMLEscapingAggregationState to templates

2017-06-02 Thread JIRA (on behalf of Federico Grilli) 
Title: Message Title


 
 
 
 

 
 
 

 
   
 Federico Grilli updated an issue  
 

  
 
 
 
 

 
 
  
 
 
 
 

 
 Magnolia _javascript_ Models /  JSMODELS-8  
 
 
  _javascript_ObjectFactory should expose HTMLEscapingAggregationState to templates   
 

  
 
 
 
 

 
Change By: 
 Federico Grilli  
 
 
Assignee: 
 Jaroslav Simak  
 

  
 
 
 
 

 
 
 

 
 
 Add Comment  
 

  
 

  
 
 
 
  
 

  
 
 
 
 

 
 This message was sent by Atlassian JIRA (v7.2.6#72008-sha1:26175bf)  
 
 

 
   
 

  
 

  
 

   




For list details, see: http://www.magnolia-cms.com/community/mailing-lists.html
Alternatively, use our forums: http://forum.magnolia-cms.com/
To unsubscribe, E-mail to: 

[magnolia-dev] [JIRA] (JSMODELS-8) JavascriptObjectFactory should expose HTMLEscapingAggregationState to templates

2017-06-01 Thread JIRA (on behalf of Federico Grilli) 
Title: Message Title


 
 
 
 

 
 
 

 
   
 Federico Grilli created an issue  
 

  
 
 
 
 

 
 
  
 
 
 
 

 
 Magnolia _javascript_ Models /  JSMODELS-8  
 
 
  _javascript_ObjectFactory should expose HTMLEscapingAggregationState to templates   
 

  
 
 
 
 

 
Issue Type: 
  Bug  
 
 
Assignee: 
 Jaroslav Simak  
 
 
Created: 
 01/Jun/17 7:18 PM  
 
 
Priority: 
  Neutral  
 
 
Reporter: 
 Federico Grilli  
 

  
 
 
 
 

 
 
 

 
 
 Add Comment  
 

  
 

  
 
 
 
  
 

  
 
 
 
 

 
 This message was sent by Atlassian JIRA (v7.2.6#72008-sha1:26175bf)  
 
 

 
   
 

  
 

  
 

   




For list details, see: http://www.magnolia-cms.com/community/mailing-lists.html
Alternatively, use our forums: http://forum.magnolia-cms.com/
To unsubscribe, E-mail to: 
---

[magnolia-dev] [JIRA] (JSMODELS-8) JavascriptObjectFactory should expose HTMLEscapingAggregationState to templates

2017-06-01 Thread JIRA (on behalf of Federico Grilli) 
Title: Message Title


 
 
 
 

 
 
 

 
   
 Federico Grilli updated an issue  
 

  
 
 
 
 

 
 
  
 
 
 
 

 
 Magnolia _javascript_ Models /  JSMODELS-8  
 
 
  _javascript_ObjectFactory should expose HTMLEscapingAggregationState to templates   
 

  
 
 
 
 

 
Change By: 
 Federico Grilli  
 

  
 
 
 
 

 
 See relate issue MAGNOLIA-6448  
 

  
 
 
 
 

 
 
 

 
 
 Add Comment  
 

  
 

  
 
 
 
  
 

  
 
 
 
 

 
 This message was sent by Atlassian JIRA (v7.2.6#72008-sha1:26175bf)  
 
 

 
   
 

  
 

  
 

   




For list details, see: http://www.magnolia-cms.com/community/mailing-lists.html
Alternatively, use our forums: http://forum.magnolia-cms.com/
To unsubscribe, E-mail to: