Details
-
Bug
-
Status: Open
-
Critical
-
Resolution: Unresolved
-
1.17.0
-
None
Description
First of all: I am not sure if the topic is placed here correctly as it might only affect the wicket-Dependency that isis is using. But: As the current wicket-version (7.9.0) that is used by isis is vulnerable to it, I should be relevant to you.
I created the following HTML-document named xss_box.html:
<html> <script language="JavaScript"> window.alert("Sometext"); </script> <head> <meta http-equiv="Content-Type" content="text/html;charset=utf-8"> </head> <body>...</body> </html>
When selecting this document for an upload, usually a preview of the content will be shown. In this case the client uploading the file executes the javascript code and gets a modified preview content, as you can see in my attached images.
I do not know if later wicket-versions (currently the newest version is 7.16.0) are protected against this threat.
