留言板
Cross Site Scripting
Hey guys,
I ran into few issues when the website we built on Liferay has been penetration tested. There were two types of XSS issues we are facing at the moment.
1. Injecting malicious java-script in the URL and trying to execute it.
2. In control panel when I create a site by providing name with a bit of java-script code, it is getting executed which is a vulnerability.
My Question does Liferay have out of the box XSS protection if someone is trying to inject bad code from the URL ?
Liferay Portal 6.2.1 GA2 CE
MySql 5.5
Java 7u56
Many thanks,
/Sharan
I ran into few issues when the website we built on Liferay has been penetration tested. There were two types of XSS issues we are facing at the moment.
1. Injecting malicious java-script in the URL and trying to execute it.
2. In control panel when I create a site by providing name with a bit of java-script code, it is getting executed which is a vulnerability.
My Question does Liferay have out of the box XSS protection if someone is trying to inject bad code from the URL ?
Liferay Portal 6.2.1 GA2 CE
MySql 5.5
Java 7u56
Many thanks,
/Sharan
Sharana Basavaraj Ballari:
Hey guys,
I ran into few issues when the website we built on Liferay has been penetration tested. There were two types of XSS issues we are facing at the moment.
1. Injecting malicious java-script in the URL and trying to execute it.
2. In control panel when I create a site by providing name with a bit of java-script code, it is getting executed which is a vulnerability.
My Question does Liferay have out of the box XSS protection if someone is trying to inject bad code from the URL ?
Liferay Portal 6.2.1 GA2 CE
MySql 5.5
Java 7u56
Many thanks,
/Sharan
This was fixed in 6.2 CE GA4 - See LPS-42754. You should upgrade to the latest CE GA4.
Sharana Basavaraj Ballari,修改在8 年前。
RE: Cross Site Scripting
Regular Member 帖子: 139 加入日期: 07-9-10 最近的帖子James Falkner:
Sharana Basavaraj Ballari:Hey guys,
I ran into few issues when the website we built on Liferay has been penetration tested. There were two types of XSS issues we are facing at the moment.
1. Injecting malicious java-script in the URL and trying to execute it.
2. In control panel when I create a site by providing name with a bit of java-script code, it is getting executed which is a vulnerability.
My Question does Liferay have out of the box XSS protection if someone is trying to inject bad code from the URL ?
Liferay Portal 6.2.1 GA2 CE
MySql 5.5
Java 7u56
Many thanks,
/Sharan
This was fixed in 6.2 CE GA4 - See LPS-42754. You should upgrade to the latest CE GA4.
Hey James,
Thank you. I understand that. For the URL injection of parameters, I am planning to implement a Filter Hook which implements Antisamy and clean the parameters and the process the request. Do you think this is the right way to do it? Or Liferay has already in place to handle this situation?
Please guide us.
Many thanks,
/Sharan