[SLING-11622] Unexpected input may cause xss risk in Taxonomy

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: App CMS 1.1.0
• Fix Version/s: App CMS 1.1.2
• Component/s: App CMS
• Assignee: Dan Klco
• Reporter: QSec-Team
• Created: 18/Oct/22 08:12
• Updated: 02/Nov/22 11:56
• Resolved: 02/Nov/22 11:56

Description

when we use sling-cms demo ，we find it that input in [+taxonomy item]  may cause the XSS vulnerability。

some one like eg.

//代码占位符
"><svg onload=alert('xss')></svg>