ICEfaces
  1. ICEfaces
  2. ICE-7658

CLONE -Output components don't escape JavaScript

          Details

          • Type: Bug Bug
          • Status: Closed
          • Priority: Major Major
          • Resolution: Fixed
          • Affects Version/s: 1.8.2-EE-GA_P01, 2.0-Beta2
          • Fix Version/s: EE-1.8.2.GA_P04
          • Component/s: Framework, ICE-Components
          • Labels:
            None
          • Environment:
            All
          • Workaround Exists:
            Yes
          • Workaround Description:
            Hide
            Escape the value before passing it in:

            import com.icesoft.faces.util.DOMUtils;

            escaped = DOMUtils.escapeAnsi(value);
            Show
            Escape the value before passing it in: import com.icesoft.faces.util.DOMUtils; escaped = DOMUtils.escapeAnsi(value);

            Description

            The ICEfaces output component are not escaped by default which makes them vulnerable to cross site scripting attacks. The <ice:outputText> uses the escape attribute but the other output components do not (ex: <ice:selectOneMenu/>). Doing a test in a pure JSF application reveals that the JSF framework by default filters/escapes JavaScript by default.

              Activity

              Ascending order - Click to sort in descending order
              Hide
              Permalink
              Arran Mccullough added a comment -

              Customer has requested that the fixes made on the 2.x code base be added to the 1.8.x code.

              Show
              Arran Mccullough added a comment - Customer has requested that the fixes made on the 2.x code base be added to the 1.8.x code.
              Hide
              Permalink
              Ted Goddard added a comment -

              Were commits previously made on the original JIRA? If so, which one is it?

              Show
              Ted Goddard added a comment - Were commits previously made on the original JIRA? If so, which one is it?
              Hide
              Permalink
              Arran Mccullough added a comment -

              Good question, I thought cloning it would link the old JIRA too. Here is the other JIRA: http://jira.icefaces.org/browse/ICE-5854

              Show
              Arran Mccullough added a comment - Good question, I thought cloning it would link the old JIRA too. Here is the other JIRA: http://jira.icefaces.org/browse/ICE-5854
              Hide
              Permalink
              Ted Goddard added a comment -

              Fix backported to icefaces/trunk/icefaces.

              Full regression testing is necessary since a large number of components were modified.

              Show
              Ted Goddard added a comment - Fix backported to icefaces/trunk/icefaces. Full regression testing is necessary since a large number of components were modified.

                People

                • Assignee:
                  Ted Goddard
                  Reporter:
                  Arran Mccullough
                • Votes:
                  1 Vote for this issue
                  Watchers:
                  1 Start watching this issue

                  Dates

                  • Created:
                    Updated:
                    Resolved: