[TEXT-43] [XSS] StringEscapeUtils.escapeHtml() must escape ' chars to '

• Type: Improvement
• Status: Reopened
• Priority: Minor
• Resolution: Unresolved
• Fix Version/s: 1.x
• Environment: Operating System: All; Platform: All
• Assignee: Unassigned
• Reporter: Keisuke Kato
• Created: 19/Dec/09 15:00
• Updated: 19/May/17 15:44

Description

If developers putting untrusted data into attribute values using the single quote character ' and StringEscapeUtils.escapeHtml() like:

<input type='text' name='input' value='<%=StringEscapeUtils.escapeHtml(request.getParameter("input"))%>'>

Then, the attacker is able to break out of the HTML attribute context like:

hxxp://example.org/?input=' onfocus='alert(document.cookie);' id='
<input type='text' name='input' value=''onfocus='alert(document.cookie);'id=''>

I think LANG-122 is not truly fixed from this aspect (XSS).

Issue Links

• is duplicated by: LANG-1042 StringEscapeUtils.escapeHtml() does not escape single quote