[AMQ-4398] XSS vulnerability in demo web application

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 5.8.0
• Fix Version/s: 5.9.0
• Assignee: Dejan Bosanac
• Reporter: Dejan Bosanac
• Created: 21/Mar/13 10:27
• Updated: 21/Mar/13 13:28
• Resolved: 21/Mar/13 13:28

Description

Portfolio publisher servlet doesn't sanitize input. For example he following url in Firefox

http://localhost:8161/demo/portfolioPublish?count=1&refresh=%27%3E%3Cscript%3Ealert%28%27XSS%27%29;%3C/script%3E&stocks=IBMW&stocks=BEAS&stocks=MSFT&stocks=SUNW

will trigger JS code.