Javascript executes in fragment configuration type text

• Type: Bug
• Status: Closed
• Resolution: Fixed
• Affects Version/s: Master
• Fix Version/s: 7.2.10 DXP FP2, 7.2.10.1 DXP SP1
• Component/s: Fragment Administration
• Labels:
  • liferay-dxp-72-sp1
  • liferay-fixpack-dxp-2-7210
• Fix Priority: 4
• Git Pull Request: https://github.com/brianchandotcom/liferay-portal/pull/77150

Steps to Reproduce:

1. Enable Fragment Configurations
2. Add a Page Fragment Section with a configuration of type text
3. Create a new content page and add fragment
4. Change the configuration text to be "<script>alert('test')</script>"
5. Publish and view page

Expected Result:

Javascript is not executed

Actual Result:

Javascript is executed

 

Reproduced on:

Tomcat 9.0.17 + MySQL 5.7.
Portal Master GIT Commit: 5768543decf42efba87f23f0bc6a08f4152cd1a7