Details

    • Technical task
    • Status: In Progress
    • TBD
    • Resolution: Unresolved
    • None
    • None
    • None
    • Low
    • Ref App 2.11 Release Sprint 3, Ref App 2.12 Priorities

    Description

      The escapeJs function in openmrs-module-uiframework/api/src/main/java/org/openmrs/ui/framework/UiUtils.java does not escape backslash, so a patient named

      Foo \"}];alert(0);[// Bar

      would cause trouble.

      In openmrs-module-registrationapp/omod/src/webapp/pages/editSelection.gsp, seen at, for example, /registrationapp/editSection.page:

      <script type="text/javascript">
          var breadcrumbs = [
              { icon: "icon-home", link: '/' + OPENMRS_CONTEXT_PATH + '/index.htm' },
              { label: "${ ui.escapeJs(ui.format(patient)) }", link: "${ ui.encodeHtml(returnUrl) }" },
              { label: "${ ui.message(section.label) }" }
          ];
      </script>
      
      <script type="text/javascript">
          var breadcrumbs = [
              { icon: "icon-home", link: '/' + OPENMRS_CONTEXT_PATH + '/index.htm' },
              { label: "Foo \\"}];alert(0);[// Bar", link: "/openmrs/coreapps/clinicianfacing/patient.page?patientId=e0a08797-70c3-497f-ba7a-29ec32ea3baf&amp;" },
              { label: "Demographics" }
          ];
      </script>
      

      Gliffy Diagrams

        Attachments

          Activity

            People

              jnsereko Nsereko Joshua
              nspin Nick Spinale
              Votes:
              0 Vote for this issue
              Watchers:
              10 Start watching this issue

              Dates

                Created:
                Updated: