[
https://issues.apache.org/jira/browse/SLING-13338?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Joerg Hoh updated SLING-13338:
------------------------------
Description:
A method used by consumers to check whether input required sanitization did not
account for adjustments made by the underlying sanitization logic in one
specific area, which could cause that check to report input as safe even though
the full sanitization process would have modified it.
Details:
* XSSFilter: check() blind to CSS violations filter would strip
Commit:
https://github.com/apache/sling-org-apache-sling-xss/commit/b85d33f714e233d3bc3181ab0ee07a12c8ecf787
was:
A method used by consumers to check whether input required sanitization did not
account for adjustments made by the underlying sanitization logic in one
specific area, which could cause that check to report input as safe even though
the full sanitization process would have modified it.
Commit:
> Validation-check API did not reflect certain sanitization outcomes
> ------------------------------------------------------------------
>
> Key: SLING-13338
> URL: https://issues.apache.org/jira/browse/SLING-13338
> Project: Sling
> Issue Type: Improvement
> Components: XSS Protection API
> Reporter: Joerg Hoh
> Assignee: Joerg Hoh
> Priority: Major
> Fix For: XSS Protection API 2.4.12
>
>
> A method used by consumers to check whether input required sanitization did
> not account for adjustments made by the underlying sanitization logic in one
> specific area, which could cause that check to report input as safe even
> though the full sanitization process would have modified it.
> Details:
> * XSSFilter: check() blind to CSS violations filter would strip
> Commit:
> https://github.com/apache/sling-org-apache-sling-xss/commit/b85d33f714e233d3bc3181ab0ee07a12c8ecf787
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
