Critical Steps to Reproduce
<zscript><![CDATA[ ListModel model = new ListModelList(); ]]></zscript> <chosenbox width="100%" creatable="true" model="${model}" onSearch="model.add(event.value);model.addToSelection(event.value)"/>
1. enter '"><img src=foo onerror=alert(/XSS-/+location)>
Current Result
it runs javascript
Expected Result
no js run
Debug Information
- chosenbox should conform All Input Components Block XSS
- relates to
-
ZK-5260 chosenbox options don't escape HTML characters
-
- Closed
-