[DELTASPIKE-1307] Deltaspike JSF: XSS WindowIdHtmlRenderer.java

• Type: Bug
• Status: Resolved
• Priority: Blocker
• Resolution: Fixed
• Affects Version/s: 1.8.0
• Fix Version/s: 1.8.1
• Component/s: JSF-Module
• Labels: security
• Environment: any
• Assignee: Mark Struberg
• Reporter: Markus 'md' Drenger
• Created: 20/Dec/17 14:39
• Updated: 09/Jan/18 09:51
• Resolved: 30/Dec/17 14:40

Description

10 chars ough to be enough for XSS.
Try escaping your variables.

https://github.com/apache/deltaspike/blob/master/deltaspike/modules/jsf/impl/src/main/java/org/apache/deltaspike/jsf/impl/component/window/WindowIdHtmlRenderer.java

Line 80

PoC
dswid='open()'