Actions
Bug #16020
closedReflective XSS in Smart Variables
Difficulty:
Triaged:
Bugzilla link:
Pull request:
Description
Cloned from https://bugzilla.redhat.com/show_bug.cgi?id=1364025
Description of problem:
Build: Satellite 6.2 snap 21.2
Version-Release number of selected component (if applicable):
How reproducible:
Always
Steps to Reproduce:
1. Go to Smart Classes
2. Create a new variable for any class.
3. Select Array as datatype and default value as <script>alert(1)</script>
4. Select Optional Input validator and select list with [<script>alert(1)</script>] value
Actual results:
The script is run by the browser and input is not sanitized.
Expected results:
The user input should be sanitized and proper error should be thrown
Additional info:
Updated by The Foreman Bot about 8 years ago
- Status changed from New to Ready For Testing
- Pull request https://github.com/theforeman/foreman/pull/3712 added
Updated by Daniel Lobato Garcia about 8 years ago
- Target version changed from 1.7.1 to 1.6.2
Updated by Anonymous about 8 years ago
- Status changed from Ready For Testing to Closed
- % Done changed from 0 to 100
Applied in changeset cf0ce6d763014a0d637e402dc2266554b97beaa7.
Updated by Dominic Cleal about 8 years ago
- Translation missing: en.field_release set to 175
Actions