fr-manvi opened a new pull request, #1668:
URL: https://github.com/apache/wicket/pull/1668
`AjaxEditableLabel.onError` writes a validation error message into the
single-quoted script string `window.status='...'` with
`JavaScriptUtils.escapeQuotes`, which escapes `'` and `"` but not the backslash:
- a message that starts with a backslash and a quote (e.g. `\';alert(1)//`)
closes that string and runs the rest, and validation messages echo the
submitted value through `${input}`, so those characters are attacker
controlled: an XSS on an edit-in-place field
- `AjaxListPanel.append` builds the same single-quoted `Wicket.DOM.add(...,
'...')` string with the same helper
- both now call `escapeQuotesAndBackslash`, which doubles the backslash too
and is what `Link`, `ExternalLink` and `PopupSettings` already use for
single-quoted script strings
Added `AjaxEditableLabelErrorMessageEscapeTest`: it drives the label into
edit mode, submits a value that fails validation with a message beginning `\'`,
and asserts the generated `window.status` script keeps the quote inside the
string. It fails before the change and passes after.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
