[
https://issues.apache.org/jira/browse/OFBIZ-6506?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14623881#comment-14623881 ]
Jacques Le Roux edited comment on OFBIZ-6506 at 7/14/15 4:05 PM:
-----------------------------------------------------------------
Something I wanted intially to say but forgot and is not intended to only you Lilian but to all OFBiz contributors: if you ever find real XSS vulnerability, you should not disclose it like Lilian did here (fortunately it's not a real one, as long as not proved otherwise). You should rather follow the process which is explained on the "The Apache Security Team" page:
http://www.apache.org/security Note that this page is also referenced in the "Security Vulnerabilities" section at the bottom of "OFBiz download" patge
http://ofbiz.apache.org/download.html.
As it said intially on this page:
bq. We strongly encourage folks to report security vulnerabilities to one of our private security mailing lists first, before disclosing them in a public forum.
The rest is explained there...
was (Author: jacques.le.roux):
Something I wanted intially to say but forgot and is not intended to only you Lilian but to all OFBiz contributors: if you ever find real XSS vulnerability, you should not disclose it like Lilian did here (fortunately it's not a real one, as long as not proved otherwise). You should rather follow the process which is explained on the "The Apache Security Team" page:
http://www.apache.org/security Note that this page is also reference in the "Security Vulnerabilities" section at the bottom of "OFBiz download" patge
http://ofbiz.apache.org/download.html.
As it said intially on this page:
bq. We strongly encourage folks to report security vulnerabilities to one of our private security mailing lists first, before disclosing them in a public forum.
The rest is explained there...
> XSS vulnerability in OFBiz forms and screens especially in display-entity component
> -----------------------------------------------------------------------------------
>
> Key: OFBIZ-6506
> URL:
https://issues.apache.org/jira/browse/OFBIZ-6506> Project: OFBiz
> Issue Type: Bug
> Components: ALL COMPONENTS
> Reporter: Lilian Iatco
> Assignee: Jacques Le Roux
> Labels: display, entity, form, ofbiz, screen, vulnerability, xss
> Attachments: Tooltip no XSS issue.png
>
>
> In Ofbiz form need to escape characters from description column in a display-entity tag to avoid XSS attacks.
> {code}<display-entity entity-name="Table" description="${description}" >{code}
> I tried to use bsh, as following:
> {code}<display-entity entity-name="Table" description="${bsh: org.apache.commons.lang.StringEscapeUtils.escapeHtml("${description}")}">{code}
> But I get this error:
> {code}
> Error rendering screen [component://my/widget/CommonScreens.xml#GlobalDecorator]: java.lang.IllegalStateException: This object has been flagged as immutable (unchangeable), probably because it came from an Entity Engine cache. Cannot set a value in an immutable entity object.
> (This object has been flagged as immutable (unchangeable), probably because it came from an Entity Engine cache. Cannot set a value in an immutable entity object.)
> {code}
> PS:
> Also you can see here a similar issue:
>
http://stackoverflow.com/questions/30097370/how-to-escape-characters-in-ofbiz-widget--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
Locked
