Details
-
Bug
-
Status: Closed (View Workflow)
-
TBD
-
Resolution: Done
-
None
-
None
-
-
ERM Sprint 160, ERM Sprint 161, ERM Sprint 162
-
Bienenvolk
-
Orchid (R1 2023) Bug Fix
Description
Overview: html not escaped in URL link field
Steps to Reproduce:
- Log into some FOLIO environment as User X
- Click dashboard app
- Create a widget and input javascript:alert('xss') to Url link field
- Save the dashboard and click Link to app
Expected Results:
The javascript should not be executed
Actual Results:
The javascript is executed
Additional Information:
URL: tested on https://okapi-bugfest-nolana.int.aws.folio.org
Interested parties:
Attachments
Issue Links
- defines
-
ERM-2895 ui-dashboard release. Fix version: 4.0.1 (Orchid Bug Fix)
-
- Closed
-
- relates to
-
-
- Closed
-
- to be improved by
-
-
- Closed
-
- mentioned in
-
Page Loading...
-
-
-
-
-
-
-
-