[jira] [Created] (DELTASPIKE-1307) Deltaspike JSF: XSS WindowIdHtmlRenderer.java

[md (JIRA)]

md created DELTASPIKE-1307:
------------------------------

             Summary: Deltaspike JSF: XSS WindowIdHtmlRenderer.java
                 Key: DELTASPIKE-1307
                 URL: https://issues.apache.org/jira/browse/DELTASPIKE-1307
             Project: DeltaSpike
          Issue Type: Bug
          Components: JSF-Module
    Affects Versions: 1.8.0
         Environment: any
            Reporter: md


10 chars ough to be enough for XSS.
Try escaping your variables.

https://github.com/apache/deltaspike/blob/master/deltaspike/modules/jsf/impl/src/main/java/org/apache/deltaspike/jsf/impl/component/window/WindowIdHtmlRenderer.java

Line 80

PoC
dswid='-open()-'



--
This message was sent by Atlassian JIRA
(v6.4.14#64029)