Skip to:

  1. Skip to Jira Navigation
  2. Skip to Side Navigation
  3. Skip to Main Content

change HtmlEditFormat and HtmlCodeFormat to default to ESAPI encoders (Lucee 6)

Description

HtmlEditFormat and HtmlCodeFormat use an older approach to html encode which doesn't handle escaping as well as the ESAPI library, leading to vulnerabilities.

https://docs.lucee.org/reference/functions/htmlcodeformat.html
https://docs.lucee.org/reference/functions/htmleditformat.html

Let's change the default version to be ESAPI

Activity

Show:

Details

Assignee

Reporter

Labels

New Issue warning screen

Before you create a new Issue, please post to the mailing list first https://dev.lucee.org

Once the issue has been verified, one of the Lucee team will ask you to file an issue

Priority

Created 30 August 2021 at 12:58
Updated 30 August 2021 at 12:58