Uploaded image for project: 'Magnolia'
  1. Magnolia
  2. MAGNOLIA-3867

XSS vulnerability in Magnolia Inbox

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Fixed
    • Icon: Blocker Blocker
    • 4.4.6
    • 4.4.5
    • workflow
    • any

      We figured out that a content operator (editor) can put javascript code to the activation dialog.

      The JS code will be executed on the publisher inbox.
      To avoid this, change the line (in class info.magnolia.module.workflow.inbox.Inbox):

      ============
      list.addColumn(new ListColumn("comment", msgs.get("inbox.comment"), "200", true));
      ============

      to the following:

      ============
      list.addColumn(new ListColumn() {

      { setName("comment"); setLabel(msgs.get("inbox.comment")); setWidth("200px"); setSeparator(true); }

      @Override
      public Object getValue()

      { openwfe.org.engine.workitem.StringAttribute str = (openwfe.org.engine.workitem.StringAttribute) super.getValue(); return StringEscapeUtils.escapeHtml(str.getValue().toString()); }

      });
      ============

        Acceptance criteria

              ochytil Ondrej Chytil
              smitty Martin Schmid
              Votes:
              0 Vote for this issue
              Watchers:
              0 Start watching this issue

                Created:
                Updated:
                Resolved:

                  Bug DoR
                  Task DoD