prevent JavaScript injection with setValue() #30
Conversation
It is a bad idea to concatenate a JavaScript expression with a value that may be from a user input.
The call of
autocommit.setValue("xy\");alert(\"Hello World!");
leads to the alert window shown in the browser.
|
It appears to me that there is no functional difference between the old code and the new. That said, this is a real issue; a proper fix would be to sanitize the input string using e.g. JSoup. |
|
I had tested the two versions executeJs and callJsFunction. With callJsFunction the alert was not displayed. callJsFunction does only concatenate the functionName and calls scheduleJavaScriptInvocation() with the expression "return $0._setValue($1)". This is packed together with an array of the parameters (the value) to the client side. I don't see a string concatenation of the value. That means: I don't think that sanitization is needed. Just exchange executeJs with callJsFunction and it is fine. |
It is a bad idea to concatenate a JavaScript expression with a value that may be from a user input. The call of
autocommit.setValue("xy");alert("Hello World!"); leads to the alert window shown in the browser.