Hi Paul, you were right!!!
I did label.setEscapeModelStrings(false); in code. So I can show <b> bold text... That was my fault! Best regards, El 29/01/14 21:29, Paul Bors escribió:
No need, Wicket escapes your model objects, see Component#setEscapeModelStrings(true) for when HTML should be escaped and thus the browser won't execute it as HTML or JS. http://ci.apache.org/projects/wicket/apidocs/6.x/org/apache/wicket/Component.html#setEscapeModelStrings(boolean) That is on by default, so you should switch to using a wicket model for your label. See the bottom section 11.1 "What is a model?" of the wicket free guide at: http://wicket.apache.org/guide/guide/modelsforms.html#modelsforms_1 Also, older Wicket in Action: http://www.javaranch.com/journal/2008/10/using-wicket-labels-and-links.html On Wed, Jan 29, 2014 at 12:26 PM, Gonzalo Aguilar Delgado < [email protected]> wrote:Hi there, I'm building an application for a client and my security advisor told me about a XSS attack that can be performed on the site. When user logs-in I welcome they by Saying "Hello user". <div class="thumbnail"> <p wicket:id="message"> Hello ${realName}. Welcome to the Synapse web. </p> </div> As you can see I use I18N so this is not the real text that will show up, but's similar. I used to think that wicket validated output before building web but the white hat hacked it by just putting a fake name into the database. Too easy for me... The content of realName is: '';!--"<SCRIPT>alert('XSS')</SCRIPT>=&{()} So I ended with: Hello<b>'';!--"<script>alert('XSS')</script>=&{()} In the web page. And the script executed on login. I was thinking about baking a method into my DAO classes to validate everything that goes to the database. But it should be a better solution. Can you point me to right one? Best regards,
--------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
