[JS2-1075] possible cross site scripting during login

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 2.1.4, 2.2.1
• Component/s: Security
• Environment: all env
• Assignee: Ate Douma
• Reporter: radko keves
• Created: 22/Oct/09 11:38
• Updated: 04/Oct/11 21:04
• Resolved: 01/Mar/10 16:41

Description

user can specify during login script, which isn't html escaped in WEB-INF/templates/login/html/login.jsp page

solution, escapeHtml input strings, like this:

<%
String ln = "";
String pa = "";

Object ln_o = session.getAttribute(LoginConstants.USERNAME);
Object pa_o = session.getAttribute(LoginConstants.PASSWORD);

if (ln_o != null) ln = (String)ln_o;
if (pa_o != null) pa = (String)pa_o;

%>
<input type='hidden' name='j_username' value='<%= StringEscapeUtils.escapeHtml(ln) %>'/>
<input type='hidden' name='j_password' value='<%= StringEscapeUtils.escapeHtml(pa) %>'/>