[magnolia-dev] [JIRA] (JSMODELS-8) JavascriptObjectFactory should expose HTMLEscapingAggregationState to templates

Federico Grilli updated an issue

Magnolia Javascript Models / https://jira.magnolia-cms.com/browse/JSMODELS-8 JSMODELS-8

JavascriptObjectFactory should expose HTMLEscapingAggregationState to templates

Change By:
Federico Grilli

See relate issue MAGNOLIA-6448. Basically templates may get a vulnerable aggregation state object.
To reproduce:

- In Resources App create {{/travel-demo/models/components/textImage.js}}
-- Add the following snippet to the above file

{code}
var MyModel = function() {

this.currentURI= function() {
return " state current uri is " + state.currentURI;
};

};

new MyModel();
{code}
- Edit {{/travel-demo/templates/components/textImage.yaml}} and add the following snippet
{code}
modelPath: /travel-demo/models/components/textImage.js
class: info.magnolia.module.jsmodels.rendering.JavascriptTemplateDefinition
{code}
- Edit {{/travel-demo/templates/components/textImage.ftl}} and add the following snippet
{code}
TEST ${model.currentURI()}
{code}
- open page with malicious URI http://localhost:8080/travel/about~cf503%22%3E%3Cimg%20src%3da%20onerror%3dalert(1)%3E7af3b~
- problem shows up
- enable {{/server/rendering/engine@escapeHtml=true}} and open again the above page

https://jira.magnolia-cms.com/browse/JSMODELS-8#add-comment
Add Comment

This message was sent by Atlassian JIRA (v7.2.6#72008-sha1:26175bf)

----------

----------------------------------------------------------------

For list details, see: http://www.magnolia-cms.com/community/mailing-lists.html

Alternatively, use our forums: http://forum.magnolia-cms.com/

To unsubscribe, E-mail to: <[email protected]>

----------------------------------------------------------------