cross-site scripting finding in the netsparker scan

[Jin-Sun-tts]

Please keep any sensitive details in Google Drive.

Date of report: 07/13/2024
Severity: Medium
Due date: 10/13/2024

Due date is based on severity and described in RA-5. 15-days for Critical, 30-days for High, and 90-days for Moderate and lower.

• Analysis has been performed and an issue has been linked to address other occurrences for this class of vulnerability* (link)

* When a finding is identified, we create two issues. One to address the specific instance identified in the report. The other is to identify and address all other occurrences of this vulnerability within the application.

Brief description

two Medium vulnerabilities found and one was false-alarm, the other one relates cross-site scripting. see detail in the google doc.

[FuhuXia]

PR GSA/ckanext-datagovtheme#208 fixed this issue.