[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
XSS vulnerability in OFBiz forms
- To: bugtraq@xxxxxxxxxxxxxxxxx
- Subject: XSS vulnerability in OFBiz forms
- From: lilian_iatco@xxxxxxxxx
- Date: Wed, 15 Jul 2015 10:14:31 GMT
https://issues.apache.org/jira/browse/OFBIZ-6506
In Ofbiz form need to escape characters from description column in a
display-entity tag to avoid XSS attacks.
<display-entity entity-name="Table" description="${description}" >
I tried to use bsh, as following:
<display-entity entity-name="Table" description="${bsh:
org.apache.commons.lang.StringEscapeUtils.escapeHtml("${description}")}">
But I get this error:
Error rendering screen
[component://my/widget/CommonScreens.xml#GlobalDecorator]:
java.lang.IllegalStateException: This object has been flagged as immutable
(unchangeable), probably because it came from an Entity Engine cache. Cannot
set a value in an immutable entity object.
(This object has been flagged as immutable (unchangeable), probably because it
came from an Entity Engine cache. Cannot set a value in an immutable entity
object.)