ICEfaces
  1. ICEfaces
  2. ICE-10998

'ice.window', 'ice.view' parameters vulnerable to JS injection attack

    Details

      Description

      This behaviour makes ICEFaces vulnerable to Javascript injection attacks when accessed URLs contain Javascript code as parameter values. For ICEfaces 3.* versions only 'ice.view' parameter is vulnerable while in ICEfaces 4.* versions 'ice.view' and 'ice.window' parameters are vulnerable to JS injection attacks.

        Activity

        Hide
        Mircea Toma added a comment -

        Verify if the received window ID is valid before creating the associated scope map. Generate a new valid ID if needed.
        Applied same strategy for ice.view parameter.

        Show
        Mircea Toma added a comment - Verify if the received window ID is valid before creating the associated scope map. Generate a new valid ID if needed. Applied same strategy for ice.view parameter.
        Hide
        Ken Fyten added a comment -

        Re-opened to update description to be safe for public consumption and document specific original affected versions for each parameter.

        Show
        Ken Fyten added a comment - Re-opened to update description to be safe for public consumption and document specific original affected versions for each parameter.
        Hide
        Liana Munroe added a comment - - edited

        The Jenkins EE-3.3 maintenance branch nightly build 706 that contained the commit for this fix may have caused a regression in the showcase ace:dataTable > Row State demo on the EE-3.3 maintenance branch.

        While testing for ICE-10793 (dataTable) I came across an issue that was actually caused by the build before the commits for ICE-10793.
        When using EE-3.3.0 maintenance branch Jenkins build 706, the EE.3.3 showcase > ace:dataTable > RowState demo the demo loads incorrectly and does not function when when using any of the Selection / Visibility / Editablilty or Editing button categories. The changes checked in for build 706 were for ICE-10998. There may be other demos affected, at this point I have not yet run regressions on the ee-3.3 maintenance branch.

        This demo passes when using IF4 trunk.

        Show
        Liana Munroe added a comment - - edited The Jenkins EE-3.3 maintenance branch nightly build 706 that contained the commit for this fix may have caused a regression in the showcase ace:dataTable > Row State demo on the EE-3.3 maintenance branch. While testing for ICE-10793 (dataTable) I came across an issue that was actually caused by the build before the commits for ICE-10793 . When using EE-3.3.0 maintenance branch Jenkins build 706, the EE.3.3 showcase > ace:dataTable > RowState demo the demo loads incorrectly and does not function when when using any of the Selection / Visibility / Editablilty or Editing button categories. The changes checked in for build 706 were for ICE-10998 . There may be other demos affected, at this point I have not yet run regressions on the ee-3.3 maintenance branch. This demo passes when using IF4 trunk.
        Hide
        Mircea Toma added a comment -

        Fix REGEX expression used to check the ice.view parameter. The generated view IDs have only digits or letters in them without the : (colon) character (like IF4 has).

        Show
        Mircea Toma added a comment - Fix REGEX expression used to check the ice.view parameter. The generated view IDs have only digits or letters in them without the : (colon) character (like IF4 has).
        Hide
        Carmen Cristurean added a comment -

        Samples and tutorial tests have been run on ICEfaces-EE-3.3.0-maintenance r.48617, and ICEfaces4 trunk r.48623.
        The changes committed for this JIRA cause the tabSet-caching tutorial to fail starting with Jenkins IF4 trunk Build# 1895, see ICE-11003.

        Show
        Carmen Cristurean added a comment - Samples and tutorial tests have been run on ICEfaces-EE-3.3.0-maintenance r.48617, and ICEfaces4 trunk r.48623. The changes committed for this JIRA cause the tabSet-caching tutorial to fail starting with Jenkins IF4 trunk Build# 1895, see ICE-11003.
        Hide
        Arturo Zambrano added a comment -

        ICE-11003 has now been fixed, at the app level. Please read the observations I make in my comment in that JIRA. This issue can occur in other applications, and we need to either document the workaround or prevent it with some more code.

        Show
        Arturo Zambrano added a comment - ICE-11003 has now been fixed, at the app level. Please read the observations I make in my comment in that JIRA. This issue can occur in other applications, and we need to either document the workaround or prevent it with some more code.

          People

          • Assignee:
            Mircea Toma
            Reporter:
            Mircea Toma
          • Votes:
            0 Vote for this issue
            Watchers:
            6 Start watching this issue

            Dates

            • Created:
              Updated:
              Resolved: