search

Grails-Plugin-Consortium / grails-filterpane

Filterpane plugin for grails.
Apache License 2.0
16 stars 44 forks source link

XSS in filterpane:filterPane #72

Open marvinthepa opened 7 years ago

marvinthepa commented 7 years ago

At least when using formMethod="get", it is possible to pass HTML in the $param.op url parameter and have it executed as it is not escaped.

Tested on version 2.5.0 (branch "grails-2"), grails v. 2.5.5.

Pull request follows.