[OFBIZ-12254] XSS vulnerability for ListWorkEfforts form

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: Trunk
• Fix Version/s: Release Branch 17.12, 18.12.01
• Assignee: Jacques Le Roux
• Reporter: Xin Wang
• Created: 08/Jun/21 15:44
• Updated: 09/Jun/21 10:57
• Resolved: 09/Jun/21 10:57

Description

If `sanitizer.enable` is turned off, `ListWorkEfforts` form will be vulnerable to XSS attack, because of incomplete escaping.

Steps to reproduce:

1. Turn off `sanitizer.enable` in owasp.properties
2. Create a WorkEffort entity with name as `<script>alert(1)</script>`
3. Go to page: http://localhost:8080/workeffort/control/FindWorkEffort
4. Search for "Work Effort Name" which contains "script"