Uploaded image for project: 'ZK'
  1. ZK
  2. ZK-5453

xss in chosenbox

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Fixed
    • Icon: Critical Critical
    • 10.0.0, 9.6.5
    • 9.6.3
    • None
    • Security Level: Jimmy

      Steps to Reproduce

      <zscript><![CDATA[
ListModel model = new ListModelList();
]]></zscript>
    <chosenbox width="100%" creatable="true" model="${model}"
               onSearch="model.add(event.value);model.addToSelection(event.value)"/>

      1. enter '"><img src=foo onerror=alert(/XSS-/+location)>

      Current Result

      it runs javascript

      Expected Result

      no js run

      Debug Information

            rebeccalai rebeccalai
            hawk hawk
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

              Created:
              Updated:
              Resolved: