Uploaded image for project: 'XWiki Platform'
  1. XWiki Platform
  2. XWIKI-21107

The Pretty Name on Wiki Descriptor is not escaped

    XMLWordPrintable

Details

    • Bug
    • Resolution: Unresolved
    • Critical
    • None
    • 8.4.3, 9.0-rc-1
    • Flamingo Skin
    • None
    • Unknown

    Description

      Steps to reproduce

      1. Create a subwiki with a title 
        "><img onerror="alert(1)" src="https://www.example.com"
      2. Navigate to the subwiki

      Expected results
      No popup should be displayed.

      Actual results
      When navigating to a page from the subwiki, a popup is displayed.

      Attachments

        Issue Links

          is caused by

          Improvement - An improvement or enhancement to an existing feature or task. XWIKI-13070 Better organisation of Drawer's entries

          • Major - Major loss of function.
          • Closed

          Activity

            People

              Unassigned Unassigned
              iandriuta Ilie Andriuta
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

                Created:
                Updated: