| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Wed, 15 Jul 2015 10:14:31 GMT
From: lilian_iatco@...oo.com
To: bugtraq@...urityfocus.com
Subject: XSS vulnerability in OFBiz forms
https://issues.apache.org/jira/browse/OFBIZ-6506
In Ofbiz form need to escape characters from description column in a display-entity tag to avoid XSS attacks.
<display-entity entity-name="Table" description="${description}" >
I tried to use bsh, as following:
<display-entity entity-name="Table" description="${bsh: org.apache.commons.lang.StringEscapeUtils.escapeHtml("${description}")}">
But I get this error:
Error rendering screen [component://my/widget/CommonScreens.xml#GlobalDecorator]: java.lang.IllegalStateException: This object has been flagged as immutable (unchangeable), probably because it came from an Entity Engine cache. Cannot set a value in an immutable entity object.
(This object has been flagged as immutable (unchangeable), probably because it came from an Entity Engine cache. Cannot set a value in an immutable entity object.)
Powered by blists - more mailing lists