[JSPWIKI-1109] ReferredPagesPlugin with illegal characters in parameters causes XSS vulnerability

• Type: Improvement
• Status: Closed
• Priority: Minor
• Resolution: Fixed
• Fix Version/s: 2.11.0-M4
• Assignee: Unassigned
• Reporter: Dirk Frederickx
• Created: 24/Apr/19 16:51
• Updated: 29/May/19 22:30
• Resolved: 29/May/19 22:30

Description

Adding illegal characters (<...>) to some of the parameters of the ReferredPagesPlugin  are not properly escaped in the output of the plugin.

EG:

[{ReferredPagesPlugin page='"><svg onload=alert(/page_xss/)>' type='local|external|attachment' depth='1..8' include='regexp"><svg onload=alert(/include_xss/)>' exclude='regexp"><svg onload=alert(/exclude_xss/)>'}]