[
https://issues.apache.org/jira/browse/SLING-13334?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Joerg Hoh updated SLING-13334:
------------------------------
Description:
Several validation utility methods, intended to make untrusted input safe for
use in specific output contexts, checked a different representation of the
input than what is ultimately interpreted downstream. This could, in certain
contexts, have allowed crafted input to bypass validation and produce
unintended behavior at the point of use.
Also address excessive resource consumption in the same area.
.h5 Details
* XSSFilterImpl: getValidHref passes javascript: URLs via HTML5 entity decoding
gap
* XSSAPIImpl: getValidMultiLineComment allows </script> breakout in documented
context
* XSSAPIImpl: getValidStyleToken strings can break style attribute or element
* XSSAPIImpl: Exponential ReDoS in getValidStyleToken FUNCTION regex.
* XSSAPIImpl: getValidJSON output can terminate enclosing script element
h5. Relevant changes
* getValidMultiLineComment and getValidStyleToken are stricter
* getValidJSON now emits \u003C, \u2028, \u2029 in place of literal <, U+2028,
U+2029 wherever they occur in a string value or object key
Commit:
https://github.com/apache/sling-org-apache-sling-xss/commit/8232e9956808fccf7007f58936ca6588fe200506
was:
Several validation utility methods, intended to make untrusted input safe for
use in specific output contexts, checked a different representation of the
input than what is ultimately interpreted downstream. This could, in certain
contexts, have allowed crafted input to bypass validation and produce
unintended behavior at the point of use.
Also address excessive resource consumption in the same area.
> Fix input validation gaps
> -------------------------
>
> Key: SLING-13334
> URL: https://issues.apache.org/jira/browse/SLING-13334
> Project: Sling
> Issue Type: Improvement
> Components: XSS Protection API
> Reporter: Joerg Hoh
> Assignee: Joerg Hoh
> Priority: Major
> Fix For: XSS Protection API 2.4.12
>
>
> Several validation utility methods, intended to make untrusted input safe for
> use in specific output contexts, checked a different representation of the
> input than what is ultimately interpreted downstream. This could, in certain
> contexts, have allowed crafted input to bypass validation and produce
> unintended behavior at the point of use.
> Also address excessive resource consumption in the same area.
> .h5 Details
> * XSSFilterImpl: getValidHref passes javascript: URLs via HTML5 entity
> decoding gap
> * XSSAPIImpl: getValidMultiLineComment allows </script> breakout in
> documented context
> * XSSAPIImpl: getValidStyleToken strings can break style attribute or element
> * XSSAPIImpl: Exponential ReDoS in getValidStyleToken FUNCTION regex.
> * XSSAPIImpl: getValidJSON output can terminate enclosing script element
> h5. Relevant changes
> * getValidMultiLineComment and getValidStyleToken are stricter
> * getValidJSON now emits \u003C, \u2028, \u2029 in place of literal <,
> U+2028, U+2029 wherever they occur in a string value or object key
> Commit:
> https://github.com/apache/sling-org-apache-sling-xss/commit/8232e9956808fccf7007f58936ca6588fe200506
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
