[ https://issues.apache.org/jira/browse/OFBIZ-6506?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14623881#comment-14623881 ]
Jacques Le Roux commented on OFBIZ-6506: ---------------------------------------- Something I wanted intially to say but forgot and is not intended to only you Lilian but to all OFBiz contributors: if you ever find real XSS vulnerability, you should not disclose it like Lilian did here (fortunately it's not a real one, as long as not proved otherwise). You should rather follow the process which is explained on the "The Apache Security Team" page: http://www.apache.org/security Note that this page is also reference in the "Security Vulnerabilities" section at the bottom of "OFBiz download" patge http://ofbiz.apache.org/download.html. As it said intially on this page: bq. We strongly encourage folks to report security vulnerabilities to one of our private security mailing lists first, before disclosing them in a public forum. The rest is explained there... > XSS vulnerability in OFBiz forms and screens especially in display-entity > component > ----------------------------------------------------------------------------------- > > Key: OFBIZ-6506 > URL: https://issues.apache.org/jira/browse/OFBIZ-6506 > Project: OFBiz > Issue Type: Bug > Components: ALL COMPONENTS > Reporter: Lilian Iatco > Assignee: Jacques Le Roux > Labels: display, entity, form, ofbiz, screen, vulnerability, xss > Attachments: Tooltip no XSS issue.png > > > In Ofbiz form need to escape characters from description column in a > display-entity tag to avoid XSS attacks. > {code}<display-entity entity-name="Table" description="${description}" >{code} > I tried to use bsh, as following: > {code}<display-entity entity-name="Table" description="${bsh: > org.apache.commons.lang.StringEscapeUtils.escapeHtml("${description}")}">{code} > But I get this error: > {code} > Error rendering screen > [component://my/widget/CommonScreens.xml#GlobalDecorator]: > java.lang.IllegalStateException: This object has been flagged as immutable > (unchangeable), probably because it came from an Entity Engine cache. Cannot > set a value in an immutable entity object. > (This object has been flagged as immutable (unchangeable), probably because > it came from an Entity Engine cache. Cannot set a value in an immutable > entity object.) > {code} > PS: > Also you can see here a similar issue: > http://stackoverflow.com/questions/30097370/how-to-escape-characters-in-ofbiz-widget -- This message was sent by Atlassian JIRA (v6.3.4#6332)