XSL Content Portlet can utilize file:/// to potentially access files on the system

• Type: Bug
• Status: Closed
• Resolution: Fixed
• Affects Version/s: 5.1.2, 5.2.3, 6.0.5 GA
• Fix Version/s: 6.0.6 GA, 6.1.0 CE RC1
• Component/s: Content Display Widgets > XSL Content widget
• Labels: None
• Environment: Win7, Linux, Tomcat 6.x, GlassFish
• Branch Version/s:
  6.0.x, 5.2.x, 5.1.x
• Backported to Branch:
  Committed

The XSL Content Portlet paths for XSL and XML content accept the "file:///" path, granting it access to files across the system and outside of the path for the appserver. As is, the portlet only reads XSL and XML content, but can pose a further risk.