Uploaded image for project: 'PUBLIC - Liferay Portal Community Edition'
  1. PUBLIC - Liferay Portal Community Edition
  2. LPS-89143

XSS when select web content in Web Content Display

    Details

      Description

      Steps to reproduce:

      1. Create a web content named "<script>alert(123);</script>"
      2. Add a Web Content Display portlet to the page
      3. Click the link "Select Web Content to make it visible" in Web Content Display portlet
      4. Click "Select" button in Web Content Display Configuration
      5. Close the alert and save the configuration

      Expected Result:
      No popup displays.

      Actual Result:
      A popup displays at step 4 and 5.

        Attachments

          Issue Links

            Activity

              People

              • Assignee:
                lu.liu Lu Liu
                Reporter:
                lu.liu Lu Liu
                Participants of an Issue:
                Recent user:
                Clarissa Velazquez
              • Votes:
                0 Vote for this issue
                Watchers:
                1 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved:
                  Days since last comment:
                  37 weeks, 6 days ago

                  Packages

                  Version Package
                  7.1.10 DXP FP7
                  7.1.10.2 SP2
                  7.1.3 CE GA4
                  7.1.X
                  Master