Uploaded image for project: 'PUBLIC - Liferay Portal Community Edition'
  1. PUBLIC - Liferay Portal Community Edition
  2. LPS-64607

Category titles are double escaped in <liferay-ui:asset-categories-selector>

    Details

      Description

      1. Add a category to the default vocabulary with the name <script>alert(123)</script>
      2. Add a blog entry that uses this category
      3. Edit the blog entry
      4. View the page's HTML source
      5. Search for Liferay.AssetCategoriesSelector
      6. For for the value of "curEntries"

      Result

      \x26lt;script\x26gt;alert(123)\x26lt;/script\x26gt;

      Expected Result

      \x3cscript\x3ealert(123)\x3c/script\x3e

        Attachments

        1. fix.png
          fix.png
          26 kB
        2. reproduce.png
          reproduce.png
          49 kB

          Issue Links

            Activity

              People

              • Assignee:
                ian.song Ian Song (Inactive)
                Reporter:
                samuel.kong Samuel Kong
                Participants of an Issue:
                Recent user:
                Esther Sanz
              • Votes:
                0 Vote for this issue
                Watchers:
                1 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved:
                  Days since last comment:
                  4 years, 25 weeks, 4 days ago

                  Packages

                  Version Package
                  6.2.X EE
                  7.0.0 CE RC1