Uploaded image for project: 'Service Packs and Hot Fixes'
  1. Service Packs and Hot Fixes
  2. MNT-12234

Possible to insert javascript code in taskId parameter

    Details

    • Type: Service Pack Request
    • Status: Closed
    • Resolution: Fixed
    • Affects Version/s: 4.2.2
    • Fix Version/s: 4.2.4
    • Component/s: Share Application
    • Labels:
    • Environment:
      Ubuntu 12.04 LTS X64 | MySQL 5.6 | Tomcat 7.0.42

      Description

      [ Steps to reproduce ]

      1. Insert URL:
        http://localhost:8080/share/page/workflow-details?taskId=%22+onclick%3djavascript%3aalert%28String.fromCharCode%2878,67,67,32,88,83,83,32,84,69,83,84%29%29+a%3d%22&referrer=tasks
      1. Log in as admin
      2. Click on Task Details

      [ Actual result ]
      Javascript popup message displayed (see screenshot attached)

      [ Expected result ]
      Javascript code not to be run

      [ Notes ]
      Reproducible on Firefox and IE. Not reproducible in chrome

        Attachments

          Structure

            Activity

              People

              • Assignee:
                closedbugs Closed Bugs (Inactive)
                Reporter:
                rvellozo Ricardo Vellozo
              • Votes:
                0 Vote for this issue
                Watchers:
                6 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved:

                  Time Tracking

                  Estimated:
                  Original Estimate - Not Specified
                  Not Specified
                  Remaining:
                  Remaining Estimate - 0 minutes
                  0m
                  Logged:
                  Time Spent - 3 hours
                  3h

                    Structure Helper Panel