[TAP5-1057] XSS vulnerability in calendar component

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 5.1.0.5
• Fix Version/s: 5.2.0
• Component/s: tapestry-core
• Labels: XSS
• Assignee: Christophe Cordenier
• Reporter: François Facon
• Created: 17/Mar/10 16:07
• Updated: 01/Sep/10 06:21
• Resolved: 01/Sep/10 06:19

Description

The calendar component provided in tapestry 5.1.0.5 could be used to allow code injection by malicious web users into any page that uses datefield .

To reproduce the vulnerability, put js code like <script>alert("T5 is great"); </script> in any datefield and click on the related calendar bitma

After quick search in the DateField.js, it seems like the field value is not escaping

escaping with a change like var value = escape($F(this.field)); the field value seems solve this vulnerability.

Issue Links

• is cloned by: TAP5-1262 XSS vulnerability in calendar component (apply to 5.1.0.x)