Uploaded image for project: 'ColdBox Platform'
  1. COLDBOX-237

Some HTMLHelper method still need escaping as certain values should never be HTML

    Details

    • Type: Improvement
    • Status: Resolved (View workflow)
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: None
    • Fix Version/s: 5.1.3
    • Component/s: HTMLHelper
    • Labels:
      None

      Description

      Ticket COLDBOX-236 Open missed a few places where text needs to be escaped before embedded into HTML to prevent XSS attacks and markup errors. In each of the examples below, HTML should never be passed in and it is safe always escape the text to ensure any special characters are not mistaken as HTML by the browser.

      • The "meta" function's content variable.
        buffer.append('<meta #arguments.type#="#arguments.name#" content="#arguments.content#" />');
        
      • The "meta" functions content variable when an array of structs:
        buffer.append('<meta #arguments.name[x].type#="#arguments.name[x].name#" content="#arguments.name[x].content#" />');
        
      • Both places src is output in the "video" function
      • Both places src is output int he "audio" function
      • option "value" in the "options" function
        buffer.append('<option value="#thisValue#"');
        
      • Option name in the "options" function
        buffer.append(">#thisName#</option>");
        
      • JS and CSS includes in the "addAsset" function
        // Load Asset
        if( listLast(thisAsset,".") eq "js" ){
        	sb.append('<script src="#jsPath##thisAsset#" type="text/javascript"#asyncStr##deferStr#></script>');
        }
        else{
        	sb.append('<link href="#cssPath##thisAsset#" type="text/css" rel="stylesheet" />');
        }
        
      • The "value" parameter in the "textArea" function

        Gliffy Diagrams

          Attachments

            Issue links

              Activity

                People

                • Assignee:
                  lmajano Luis Majano
                  Reporter:
                  bradwood Brad Wood
                • Votes:
                  0 Vote for this issue
                  Watchers:
                  1 Start watching this issue

                  Dates

                  • Created:
                    Updated:
                    Resolved: