Answers to: Cross site scripting - XSS

Comment by Reguel Wermelinger on SupportIvyTeam's answer

Reguel Wermelinger — Wed, 09 Oct 2019 04:17:26 -0400

I'd say that primefaces components are by default save and tested to not be vulnerable to XSS attacks. However, once the user prints data of the Html Dialog (collected via inputText elements and similar) directly on the front-end, then the developer has to ensure that is done in safe way. Especially plain El-Expressions that access data outside of a JSF widget build for it are vulnerable for the light-hearted introduced of new security issues. To make implementations save: always use 'value' attributes of primefaces components built to output users input.

Answer by SupportIvyTeam

SupportIvyTeam — Fri, 04 Oct 2019 05:09:19 -0400

Hi John

Generally every jsf and primefaces component does the escapting as long as it is not activly set to false by a developer on a component.

Comment by John Moser on John Moser's question

John Moser — Thu, 03 Oct 2019 10:46:18 -0400

May be I have to ask it more generally. If I have a input field and I enter :

This is my test <script>alert(123)</script>

This text gets stored exactly as it is and if we use a JSF and/or Primefaces control to display it, we get a JS alert 123-dialog.

So what is the Ivy approach - do I have to encode it after the text got inputed or must all text get displayed escaped. I would assume this topic has already been investigated by you and there must be some rules to follow to avoid XSS.

Comment by Reguel Wermelinger on John Moser's question

Reguel Wermelinger — Thu, 03 Oct 2019 10:05:16 -0400

I can not see an 'escape' attribute on p:inputText or similar elements. To which control are you exactly referring?