[OFBIZ-10054] Product content management screen doesn't validate trusted users' input

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: Release Branch 16.11, Trunk
• Fix Version/s: 16.11.06, 17.12.01, 18.12.01
• Component/s: product
• Assignee: Jacques Le Roux
• Reporter: Jacopo Cappellato
• Created: 14/Dec/17 16:29
• Updated: 17/May/19 10:13
• Resolved: 09/May/19 06:16

Description

Steps to recreate:

1) go to (authenticate with admin/ofbiz):
https://localhost:8443/catalog/control/EditProductContent?productId=WG-1111

2) set the content of the field labeled "Large Image" to:
non_existent.foo" onerror="alert('Hi!');

3) visit the url:
https://localhost:8443/ecommerce/control/product?product_id=WG-1111

A popup message will appear with the "Hi!".

Thanks to Loris Nardo for the report.

Issue Links

• is a child of: OFBIZ-1525 Issue to group security concerns
• is related to: OFBIZ-5254 Services allow arbitrary HTML for parameters with allow-html set to "safe"