[JENA-1123] Cross Site Scripting (XSS) vulnerability on Fuseki 2.3.1

• Type: Bug
• Status: Closed
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: Fuseki 2.3.1
• Fix Version/s: Fuseki 2.4.0
• Component/s: Fuseki
• Labels: security xss
• Assignee: Andy Seaborne
• Reporter: Massimiliano Ricci
• Created: 27/Jan/16 14:32
• Updated: 17/Aug/16 16:21
• Resolved: 31/Jan/16 15:33

Description

In fuseki web interface, dataset.html page -> tab "query"
it's possible to write query like:

SELECT 
      ("<b>hello</b>" AS ?Y)
      ("<script>alert(document.domain)</script>" AS ?X) 
WHERE { }

that show a pop-up with hostname.
Probably the problem is with the YASQE dependency.