[jira] [Updated] (OFBIZ-6506) XSS vulnerability in OFBiz forms and screens especially in display-entity

[Nicolas Malin (Jira)]

     [ https://issues.apache.org/jira/browse/OFBIZ-6506?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Lilian Iatco updated OFBIZ-6506:
--------------------------------
    Description:
In Ofbiz form need to escape characters from description column in a display-entity tag to avoid XSS attacks.

<display-entity entity-name="Table" description="${description}" >

I tried to use bsh, as following:

<display-entity entity-name="Table" description="${bsh: org.apache.commons.lang.StringEscapeUtils.escapeHtml(&quot;${description}&quot;)}">

But I get this error:

Error rendering screen [component://my/widget/CommonScreens.xml#GlobalDecorator]: java.lang.IllegalStateException: This object has been flagged as immutable (unchangeable), probably because it came from an Entity Engine cache. Cannot set a value in an immutable entity object.
(This object has been flagged as immutable (unchangeable), probably because it came from an Entity Engine cache. Cannot set a value in an immutable entity object.)

Also you can see here a similar issue:
http://stackoverflow.com/questions/30097370/how-to-escape-characters-in-ofbiz-widget

  was:
In Ofbiz form need to escape characters from description column in a display-entity tag to avoid XSS attacks.
<display-entity entity-name="Table" description="${description}" >

I tried to use bsh, as following:
<display-entity entity-name="Table" description="${bsh: org.apache.commons.lang.StringEscapeUtils.escapeHtml(&quot;${description}&quot;)}">

But I get this error:
Error rendering screen [component://my/widget/CommonScreens.xml#GlobalDecorator]: java.lang.IllegalStateException: This object has been flagged as immutable (unchangeable), probably because it came from an Entity Engine cache. Cannot set a value in an immutable entity object.
(This object has been flagged as immutable (unchangeable), probably because it came from an Entity Engine cache. Cannot set a value in an immutable entity object.)

Also you can see here a similar issue:
http://stackoverflow.com/questions/30097370/how-to-escape-characters-in-ofbiz-widget

> XSS vulnerability in OFBiz forms and screens especially in display-entity
> -------------------------------------------------------------------------
>
>                 Key: OFBIZ-6506
>                 URL: https://issues.apache.org/jira/browse/OFBIZ-6506
>             Project: OFBiz
>          Issue Type: Bug
>          Components: ALL COMPONENTS
>            Reporter: Lilian Iatco
>              Labels: entity, form, xss
>
> In Ofbiz form need to escape characters from description column in a display-entity tag to avoid XSS attacks.
> <display-entity entity-name="Table" description="${description}" >
> I tried to use bsh, as following:
> <display-entity entity-name="Table" description="${bsh: org.apache.commons.lang.StringEscapeUtils.escapeHtml(&quot;${description}&quot;)}">
> But I get this error:
> Error rendering screen [component://my/widget/CommonScreens.xml#GlobalDecorator]: java.lang.IllegalStateException: This object has been flagged as immutable (unchangeable), probably because it came from an Entity Engine cache. Cannot set a value in an immutable entity object.
> (This object has been flagged as immutable (unchangeable), probably because it came from an Entity Engine cache. Cannot set a value in an immutable entity object.)
> Also you can see here a similar issue:
> http://stackoverflow.com/questions/30097370/how-to-escape-characters-in-ofbiz-widget

... [show rest of quote]

--
This message was sent by Atlassian JIRA
(v6.3.4#6332)