Improved XSS prevention

• Type: Improvement
• Status: Closed
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: 5.1 EE SP2 (5.1.5), 5.2 EE (5.2.4)
• Fix Version/s: 5.1 EE SP3 (5.1.6), 5.2 EE SP1 (5.2.5)
• Component/s: Application Security
• Labels:
  • 5.2_release_notes
• Environment: All

HTML strings need to be escaped differently depending on how it's used. This improvement updates JSP files to follow the recommendations outline in http://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet