https://answers.axonivy.com/questions/4054/cross-site-scripting-xss<p>Dear Ivy team</p> <p>Just recently we had a security audit which reported that our app is vulnerable to XSS attacks. The issue is that the Primeface input fields (whatever control) seem not to be escaped. By default it should be escape="true" but it seems it's escape="false" which would be really bad (for all Ivy based applications).</p> <p>Any idea why this is the case ? May be an outdated jsf lib ?</p> <p>Best regards John</p>enFri, 04 Oct 2019 05:09:19 -0400https://answers.axonivy.com/questions/4054/cross-site-scripting-xss/4074<p>Hi John</p> <p>Generally every jsf and primefaces component does the escapting as long as it is not activly set to false by a developer on a component.</p>SupportIvyTeamFri, 04 Oct 2019 05:09:19 -0400https://answers.axonivy.com/questions/4054/cross-site-scripting-xss/4074