ICEfaces
  1. ICEfaces
  2. ICE-5854

Output components don't escape JavaScript

          Details

          • Type: Bug Bug
          • Status: Closed
          • Priority: Major Major
          • Resolution: Fixed
          • Affects Version/s: 1.8.2-EE-GA_P01, 2.0-Beta2
          • Fix Version/s: 2.0.0
          • Component/s: Framework, ICE-Components
          • Labels:
            None
          • Environment:
            All
          • Workaround Exists:
            Yes
          • Workaround Description:
            Hide
            Escape the value before passing it in:

            import com.icesoft.faces.util.DOMUtils;

            escaped = DOMUtils.escapeAnsi(value);
            Show
            Escape the value before passing it in: import com.icesoft.faces.util.DOMUtils; escaped = DOMUtils.escapeAnsi(value);

            Description

            The ICEfaces output component are not escaped by default which makes them vulnerable to cross site scripting attacks. The <ice:outputText> uses the escape attribute but the other output components do not (ex: <ice:selectOneMenu/>). Doing a test in a pure JSF application reveals that the JSF framework by default filters/escapes JavaScript by default.

              Activity

              Ascending order - Click to sort in descending order
              Arran Mccullough created issue -
              Arran Mccullough made changes -
              Field Original Value New Value
              Attachment Case9225Example2.war [ 12423 ]
              Arran Mccullough made changes -
              Attachment Case9225Example.war [ 12424 ]
              Arran Mccullough made changes -
              Attachment Case9225ExampleCode.zip [ 12425 ]
              Arran Mccullough made changes -
              Salesforce Case [5007000000C47HV]
              Ken Fyten made changes -
              Fix Version/s 1.8.2-EE-GA_P02 [ 10226 ]
              Fix Version/s 1.8.3 [ 10211 ]
              Ken Fyten made changes -
              Assignee Priority P1
              Assignee Greg Dick [ greg.dick ]
              Ken Fyten made changes -
              Assignee Greg Dick [ greg.dick ] Ted Goddard [ ted.goddard ]
              Ken Fyten made changes -
              Fix Version/s 2.0.0 [ 10230 ]
              Fix Version/s 1.8.3 [ 10211 ]
              Fix Version/s 1.8.2-EE-GA_P02 [ 10226 ]
              Assignee Priority P1
              Affects Version/s 2.0-Beta2 [ 10242 ]
              Ted Goddard made changes -
              Attachment showcase-additions.zip [ 12670 ]
              Ted Goddard made changes -
              Status Open [ 1 ] Resolved [ 5 ]
              Resolution Fixed [ 1 ]
              Ken Fyten made changes -
              Security Private [ 10001 ]
              Ken Fyten made changes -
              Status Resolved [ 5 ] Closed [ 6 ]

                People

                • Assignee:
                  Ted Goddard
                  Reporter:
                  Arran Mccullough
                • Votes:
                  0 Vote for this issue
                  Watchers:
                  0 Start watching this issue

                  Dates

                  • Created:
                    Updated:
                    Resolved: