[CXF-6216] No output sanitizing in FormattedServiceListWriter

• Type: Bug
• Status: Closed
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: 3.0.1
• Fix Version/s: 3.1.9, 3.0.12, 3.2.0
• Component/s: Transports
• Estimated Complexity: Unknown
• Assignee: Sergey Beryozkin
• Reporter: Donald Kwakkel
• Created: 22/Jan/15 13:31
• Updated: 22/Mar/17 17:24
• Resolved: 04/Nov/16 16:13

Description

No output sanitizing is done, which makes the code vulnerable for injection. I do not have a specific use case, but it is good habit to do. Maybe you can use the OWASP Sanitizer: https://www.owasp.org/index.php/OWASP_Java_HTML_Sanitizer_Project

One example from the file:
writer.write("<span class=\"field\">Endpoint address:</span> " + "<span class=\"value\">"
+ absoluteURL + "</span>");

Issue Links

• relates to: CXF-7128 Review the possibility of using OWASP Sanitizer in FormattedServiceListWriter