Possible Cross-site Scripting Vulnerability

XMLWordPrintable

    • Type: Bug
    • Resolution: Fixed
    • Priority: Normal
    • 6.5.4
    • Affects Version/s: 6.5.3
    • Component/s: General
    • Security Level: Jimmy
    • None

      Should sanitize pi before sending back to browser

      package org.zkoss.web.util.resource;
      
      public class ClassWebResource {
      ...
          private void web0(..., String pi, ...) {
              ...
              data = ("(window.zk&&zk.error?zk.error:alert)('"+pi+" not found');").getBytes("UTF-8");
              ...
              out.write(data);
              ...
          }
      ...
      }
      

            Assignee:
            RaymondChao
            Reporter:
            neillee
            Votes:
            0 Vote for this issue
            Watchers:
            0 Start watching this issue

              Created:
              Updated:
              Resolved: