Uploaded image for project: 'Service Interaction'
  1. Service Interaction
  2. SI-20

Extend protection against potential XSS vulnerability

    XMLWordPrintable

Details

    • ERM Sprint 160, ERM Sprint 161, ERM Sprint 162, ERM Sprint 163
    • Bienenvolk
    • Poppy (R2 2023)
    • TBD

    Description

      See SI-12 for original issue and steps to reproduce.

      Extend URL validation introduced in SI-12 that prevents execution of malicious URLs to prevent saving potentially malicious URL strings.

      Scope: 

      • Context: Create or edit dashboard widgets with URL fields
      • Applies to: URL links defined with a protocol identifier
      • Does not apply to: URL link strings defined without a protocol identifier 

      Related Prior Work: 

      Acceptance Criteria:

      • Given a string is entered in the URL link field of a dashboard widget
      • When a user attempts to save the widget
        • And the string is prefixed with a protocol identifier other than `https` or `http`
      • Then do not save the record
        • And return the user to the widget edit/create screen 
        • And highlight the invalid field with
          • error styling
          • error message: "Please enter a valid URL (starts with \"https://\", \"http://\" or \"/\" and doesn't contain special characters not allowed in URLs)"

       

      Attachments

        Issue Links

          Activity

            People

              ostephens Owen Stephens
              hji Hongwei Ji
              Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: