Issues
- html error from extension provider loaded directly into adminLDEV-3226Resolved issue: LDEV-3226Zac Spitzer
- Reflected XSS via /rest/ endpointLDEV-3106Pothys - MitrahSoft
- scriptProtect doesn't filter out tag on* attributesLDEV-3050Resolved issue: LDEV-3050
- XSS in CFX Tags in Lucee 5.2.9.31LDEV-3049Resolved issue: LDEV-3049
- XSS in REST error handlerLDEV-3023Resolved issue: LDEV-3023Igal Sapir
- XSS in Java StackTraces, REST error messageLDEV-1693Resolved issue: LDEV-1693Michael Offner
- getSafeHTML() and isSafeHTML() functions missingLDEV-838
7 of 7
html error from extension provider loaded directly into admin
Fixed
Description
Environment
None
Attachments
2
Details
Assignee
Zac SpitzerZac SpitzerReporter
Zac SpitzerZac SpitzerPriority
NewFix versions
New Issue warning screen
Before you create a new Issue, please post to the mailing list first https://dev.lucee.org
Once the issue has been verified, one of the Lucee team will ask you to file an issue
Sprint
NoneAffects versions
Details
Details
Assignee
Zac Spitzer
Zac SpitzerReporter
Zac Spitzer
Zac SpitzerPriority
NewFix versions
New Issue warning screen
Before you create a new Issue, please post to the mailing list first https://dev.lucee.org
Once the issue has been verified, one of the Lucee team will ask you to file an issue
Sprint
None
Affects versions
Created 18 January 2021 at 18:30
Updated 27 April 2022 at 17:00
Resolved 14 April 2021 at 18:11
Activity
Show:
Zac Spitzer1 April 2021 at 15:01
Zac Spitzer18 January 2021 at 19:04Edited
downloadFull throws the http response
https://github.com/lucee/Lucee/blob/5.3/core/src/main/cfml/context/admin/ext.functions.cfm#L571
PR to show safe error message
https://github.com/lucee/Lucee/pull/1156
when forgebox returns an error installing an extension, in this case my performance analyzer (forgebox says the binary is missing)
the whole forgebox error page is loaded directly into the admin, which messes everything up and is an xss risk (i know we explicitly trust extension providers, but still)
only the jquery text() of the response should be displayed (injected into the page), not the entire html response with css and js etc