Details
-
Type:
Improvement
-
Status: Closed
-
Priority:
Critical
-
Resolution: Fixed
-
Affects Version/s: 3.3, 4.0
-
Fix Version/s: EE-4.1.0.RC1, EE-4.1.0.GA, EE-3.3.0.GA_P04, 4.2.BETA, 4.2
-
Component/s: Framework
-
Labels:None
-
Environment:supported browsers
-
Assignee Priority:P1
-
Support Case References:
-
Affects:Documentation (User Guide, Ref. Guide, etc.)
Description
This behaviour makes ICEFaces vulnerable to Javascript injection attacks when accessed URLs contain Javascript code as parameter values. For ICEfaces 3.* versions only 'ice.view' parameter is vulnerable while in ICEfaces 4.* versions 'ice.view' and 'ice.window' parameters are vulnerable to JS injection attacks.
ICE-11003 has now been fixed, at the app level. Please read the observations I make in my comment in that JIRA. This issue can occur in other applications, and we need to either document the workaround or prevent it with some more code.