[CAUSEWAY-3077] [Vulnerability] Scalar Value Output Rendering is not escaped. (XSS Vulnarability)

• Type: Bug
• Status: Resolved
• Priority: Critical
• Resolution: Resolved
• Fix Version/s: 2.0.0-M8
• Component/s: Viewer Wicket
• Labels: vulnerability
• Assignee: Andi Huber
• Reporter: Jörg Rade
• Created: 15/Jun/22 13:05
• Updated: 23/Jun/22 09:01
• Resolved: 23/Jun/22 08:56

Description

Problem is with Wicket Viewer's scalar value output rendering: string value gets interpreted/executed by the browser. Vulnerability was probably introduced post M7.

see
https://the-asf.slack.com/archives/CFC42LWBV/p1655298008979249?thread_ts=1655296945.755859&cid=CFC42LWBV