Uploaded image for project: 'ZK'
  1. ZK
  2. ZK-1897

Possible Cross-site Scripting Vulnerability

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Fixed
    • Icon: Normal Normal
    • 6.5.4
    • 6.5.3
    • General
    • Security Level: Jimmy

      Should sanitize pi before sending back to browser

      package org.zkoss.web.util.resource;
      
      public class ClassWebResource {
      ...
          private void web0(..., String pi, ...) {
              ...
              data = ("(window.zk&&zk.error?zk.error:alert)('"+pi+" not found');").getBytes("UTF-8");
              ...
              out.write(data);
              ...
          }
      ...
      }
      

            RaymondChao RaymondChao
            neillee neillee
            Votes:
            0 Vote for this issue
            Watchers:
            0 Start watching this issue

              Created:
              Updated:
              Resolved: