[DELTASPIKE-1389] Sanitizing of dswid imperfect (XSS, security)

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.9.1
• Fix Version/s: 1.9.2
• Component/s: JSF-Module
• Security Level: public (Regular issues)
• Labels: security
• Assignee: Mark Struberg
• Reporter: Matthias Walliczek
• Created: 10/Oct/19 06:16
• Updated: 19/Mar/20 12:50
• Resolved: 19/Mar/20 12:50

Description

Despide that it was improving in https://issues.apache.org/jira/browse/DELTASPIKE-1307, the sanitizing of the dswid parameter is still imperfect.

PoC: request a page with "xzy.jsf?dswid=',danger,'" will render "danger" as variable into the javascript code.

Solution: Instead of filtering "(", "<" and "&" as a black list attempt which is not recommended by the OWASP, only numeric characters and "-" should be allowed as white list approach.