[ https://issues.apache.org/jira/browse/OFBIZ-6506?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15228091#comment-15228091 ]
Jacques Le Roux commented on OFBIZ-6506: ---------------------------------------- h5. For your reference the relevant fixes have been committed with following revision numbers: * trunk: 1692357 (branch 15.12 was not yet created, so includes this fix) * 14.12: 1692358 * 13.07: 1692359 * 12.04: 1692360 h5. Versions Affected: Apache OFBiz 13.07.02 and 13.07.01 Apache OFBiz 12.04.05 and earlier releases in the series (12.04.*) The unsupported releases 11.04.*, 10.04.* and 09.04 versions are also affected (Lilian reported he tried with r691692, which is early March 2008) > XSS vulnerability in OFBiz forms and screens especially in display-entity > component > ----------------------------------------------------------------------------------- > > Key: OFBIZ-6506 > URL: https://issues.apache.org/jira/browse/OFBIZ-6506 > Project: OFBiz > Issue Type: Sub-task > Components: ALL COMPONENTS > Reporter: Lilian Iatco > Assignee: Jacques Le Roux > Labels: display, entity, form, ofbiz, screen, vulnerability, xss > Attachments: Tooltip no XSS issue.png > > > In Ofbiz form need to escape characters from description column in a > display-entity tag to avoid XSS attacks. > {code}<display-entity entity-name="Table" description="${description}" >{code} > I tried to use bsh, as following: > {code}<display-entity entity-name="Table" description="${bsh: > org.apache.commons.lang.StringEscapeUtils.escapeHtml("${description}")}">{code} > But I get this error: > {code} > Error rendering screen > [component://my/widget/CommonScreens.xml#GlobalDecorator]: > java.lang.IllegalStateException: This object has been flagged as immutable > (unchangeable), probably because it came from an Entity Engine cache. Cannot > set a value in an immutable entity object. > (This object has been flagged as immutable (unchangeable), probably because > it came from an Entity Engine cache. Cannot set a value in an immutable > entity object.) > {code} > PS: > Also you can see here a similar issue: > http://stackoverflow.com/questions/30097370/how-to-escape-characters-in-ofbiz-widget -- This message was sent by Atlassian JIRA (v6.3.4#6332)