Stuck on an issue?
Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.
And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.
ColumnToggler: XSS caused by script tags in headerText of Column
See original GitHub issue1) Environment
- PrimeFaces version: 6.2.19
- Application server + version: Apache Tomcat 8.5.13
- Affected browsers: Internet Explorer 11, Firefox 67.0.3, Chrome 75
2) Expected behavior
The headerText should be treated as text in the ColumnToggler. HTML tags and code should be escaped. The headerText is already properly escaped in the DataTable’s header.
3) Actual behavior
A script tag in the headerText of a Column is executed when a ColumnToggler is attached to the DataTable and the page is loaded. The headerText is not escaped in the ColumnToggler.
4) Steps to reproduce
- Open the provided XHTML example page.
- An alert “xss” will be displayed.
5) Sample XHTML
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:h="http://java.sun.com/jsf/html" xmlns:f="http://java.sun.com/jsf/core" xmlns:p="http://primefaces.org/ui">
<h:head />
<h:body>
<p:dataTable id="table">
<f:facet name="header">
<p:commandButton id="toggler" type="button" value="Toggler" />
<p:columnToggler datasource="table" trigger="toggler" />
</f:facet>
<p:column headerText="<script>alert('xss')</script>" />
</p:dataTable>
</h:body>
</html>
6) Sample bean
Not needed.
Issue Analytics
- State:
- Created 4 years ago
- Comments:5 (3 by maintainers)
Top Results From Across the Web
PrimeFaces 6.2.22 and 7.0.5 Released
Add rangeSeparator attribute to DatePicker · ColumnToggler: XSS caused by script tags in headerText of Column · Add range selection support ...
Read more >Primefaces watermark component is added to column header ...
The problem is, that the primefaces component gets added to the header name and therefore the header names are uglified within the columnToggler...
Read more >primefaces - issue #7901 - Google Code
primefaces - issue #7901 ... On webkit content automatically fits but not on FF and IE, scrollbars are shown instead. Status: Fixed. Labels:...
Read more >primefaces - issue #5690 - Google Code
There was an error obtaining the issue: {"data":null,"status":-1,"config":{"method":"GET","transformRequest":[null],"transformResponse":[null] ...
Read more >Enabling the table columns visibility toggle
In the Section form, click a header of a column, and then click the View properties icon. Select an option for the Visibility...
Read more >
Top Related Medium Post
No results found
Top Related StackOverflow Question
No results found
Troubleshoot Live Code
Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free
Top Related Reddit Thread
No results found
Top Related Hackernoon Post
No results found
Top Related Tweet
No results found
Top Related Dev.to Post
No results found
Top Related Hashnode Post
No results found
Fixed for 6.2.22 and 7.0.5
@mertsincan Any chance to get this into 6.2.22?