Skip to:

  1. Skip to Jira Navigation
  2. Skip to Side Navigation
  3. Skip to Main Content

HTML elements viewed in 'Activities Portlet' are being escaped.

Description

1) Login as 'test@liferay.com' / 'test'.
2) Navigate to 'My Community Public Page'.
3) Add a Page.
4) Add the 'Activities Portlet' and the 'Blogs Portlet'.
5) Add a blog entry with the following titles:

<script>alert(document.domain)</script>
<script>alert(document.domain)
<script>alert(document.domain)</script>
<script>alert(document.domain)

  •  

    • Notice if you view these entries in the Activities portlet the HTML will be escaped **

    • the entries will be displayed like the following: **

<script>alert(document.domain)</script>

<script>alert(document.domain)

alert(document.domain)

I've attached a picture of what they will look will be displayed.

Environment

Tomcat 6.0 + MySQL. Firefox 3.5.7. Revision: 47533. 5.1.x. Tomcat 6.0 + MySQL. Firefox 3.5.7. Revision: 47533. 5.2.x. Tomcat 6.0 + MySQL. Firefox 3.5.7. Revision: 47584. Trunk.

Attachments

2

Activity

Show:

Michael SaechangMay 30, 2012 at 3:40 PM

Thank you Paul for testing. Closing as 'Fixed'.

Paul PiaoMay 27, 2012 at 7:46 PM

PASSED Manual Testing following the steps in the description.

Reproduced on:
Tomcat 7.0 + MySQL 5. Portal 6.1.10 EE GA1.

I can see the attachment error "activitiesescapecharacters.PNG". Activities Portlet not display "<script>alert(document.domain)</script>".

Fixed on:
Tomcat 7.0 + MySQL 5. Portal 6.1.x EE GIT ID: 6a924268fafee0af22f9b81a85dcadce8730965b.
Tomcat 7.0 + MySQL 5. Portal 6.1.x CE GIT ID: 31508f41a8a062b6f9aeb87b5b62965e53f4f36f.
Tomcat 7.0 + MySQL 5. Portal 6.2.x GIT ID: bd0ac55267f6511e477cdd37d797a10417a48f3e.

Activities Portlet display "<script>alert(document.domain)</script>".

Michael SaechangMay 25, 2012 at 11:25 AM

Committed on:
Portal 6.1.x CE GIT ID: c766aa61bdb8463cd9d78461595afa44894de88b.
Portal 6.2.x GIT ID: d60f427819145bf183c428b59df05d5c5a437da6.

Amos FongNovember 24, 2011 at 12:54 AM

Charles,

It can't be used as exploit because it's escaped again before it is displayed.

Michael SaechangOctober 18, 2011 at 4:36 PM

This has already been fixed and is no longer reproducible on the latest trunk.

Tested on 6.1.x revision: 90917.

Fixed

Details

Assignee

Reporter

Labels

Branch Version/s

6.1.x

Backported to Branch

Committed

Fix Priority

3

Git Pull Request

Bug Type

Regression Bug

Components

Fix versions

Affects versions

Priority

Zendesk Support

Created March 5, 2010 at 2:18 PM
Updated June 23, 2023 at 8:56 PM
Resolved May 25, 2012 at 10:22 AM
Loading...