search

dandelion / dandelion-datatables

Dandelion component for DataTables
http://dandelion.github.io/components/datatables/
Other
110 stars 49 forks source link

XSS in Column Tag possible #283

Closed wofwofwof closed 9 years ago

wofwofwof commented 9 years ago

Hello, I've found it while trying https://github.com/spring-projects/spring-petclinic/. On the owner page you can put in XSS in Address and City.

For me it looks like the Tags with style

<datatables:column title="City" property="city"/>

won't be escaped probably, only the title.

As far as I understand the source the fix should be in ColumnTag in method doEndTag or in AbstractColumnTag in method addDomBodyColumn. Just add the StringUtils.escape(this.escapeXml, this.property) as you have done for the title.

cheers

wof

tduchateau commented 9 years ago

Hi,

Thanks for reporting wof! Could you please provide an example of XSS?

Thanks!

wofwofwof commented 9 years ago

Hello tduchateau, in petclinic go to the owner site, there edit one owner and add 

<script>alert('xss')</script>

in Address or City, then go to the owner list again and click auf search and you will see the message.

cheers wof

tduchateau commented 9 years ago

Reproduced. Thanks!