[TAP5-1262] XSS vulnerability in calendar component (apply to 5.1.0.x)

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 5.1.0.5
• Fix Version/s: 5.2.0
• Component/s: tapestry-core
• Assignee: Christophe Cordenier
• Reporter: Christophe Cordenier
• Created: 01/Sep/10 06:21
• Updated: 08/Apr/15 08:37
• Resolved: 06/Sep/10 06:57

Description

The calendar component provided in tapestry 5.1.0.5 could be used to allow code injection by malicious web users into any page that uses datefield .

To reproduce the vulnerability, put js code like <script>alert("T5 is great"); </script> in any datefield and click on the related calendar bitma

After quick search in the DateField.js, it seems like the field value is not escaping

escaping with a change like var value = escape($F(this.field)); the field value seems solve this vulnerability.

Issue Links

• is a clone of: TAP5-1057 XSS vulnerability in calendar component