Uploaded image for project: 'Reference Application'
  1. Reference Application
  2. RA-452 XSS vulnerabilities in Ref App 2.x
  3. RA-1424

escapeJs vulnerable to XSS

    XMLWordPrintable

Details

    • Technical task
    • Status: In Progress
    • TBD
    • Resolution: Unresolved
    • None
    • None
    • None
    • Low
    • Ref App 2.11 Release Sprint 3, Ref App 2.12 Priorities

    Description

      The escapeJs function in openmrs-module-uiframework/api/src/main/java/org/openmrs/ui/framework/UiUtils.java does not escape backslash, so a patient named 

      Foo \"}];alert(0);[// Bar

      would cause trouble.

      In openmrs-module-registrationapp/omod/src/webapp/pages/editSelection.gsp, seen at, for example, /registrationapp/editSection.page:

      <script type="text/javascript">
    var breadcrumbs = [
        { icon: "icon-home", link: '/' + OPENMRS_CONTEXT_PATH + '/index.htm' },
        { label: "${ ui.escapeJs(ui.format(patient)) }", link: "${ ui.encodeHtml(returnUrl) }" },
        { label: "${ ui.message(section.label) }" }
    ];
</script>

<script type="text/javascript">
    var breadcrumbs = [
        { icon: "icon-home", link: '/' + OPENMRS_CONTEXT_PATH + '/index.htm' },
        { label: "Foo \\"}];alert(0);[// Bar", link: "/openmrs/coreapps/clinicianfacing/patient.page?patientId=e0a08797-70c3-497f-ba7a-29ec32ea3baf&amp;" },
        { label: "Demographics" }
    ];
</script>

      Gliffy Diagrams

        Attachments

          Activity

            People

              jnsereko Nsereko Joshua
              nspin Nick Spinale
              Votes:
              0 Vote for this issue
              Watchers:
              10 Start watching this issue

              Dates

                Created:
                Updated: