g:select tag has reflected/stored XSS vulnerability in grails 2 and 3 #10256
Description
Steps to Reproduce
- Use the
<g:select ../>tag - Either Provide a set of key/value pairs using
optionKeyor a list of strings with thefromattribute - Any unescaped strings, or objects with unescaped
keyare not encoded - Values via URL params, or from stored domain object would cause XSS
Example:
<%
def data=[["key":"\"></option></select><script>alert('hi')</script>", value: "option"]]
%>
<g:select name="test" from="${data}" optionKey="key" optionValue="value" />
<%
def data2=["abc","\"></option></select><script>alert('hi')</script>"]
%>
<g:select name="test" from="${data2}" />
Expected Behaviour
The value= attribute of the <option> that is generated should be properly HTML encoded.
<select name="test">
<option value=""></option></select><script>alert('hi')</script>">option</option>
</select>Actual Behaviour
The value= attribute of the <option> that is generated is not HTML encoded.
<select name="test">
<option value=""></option></select><script>alert('hi')</script>">option</option>
</select>Environment Information
- Operating System: Mac OS X 10.11.6
- Grails Version: 2.5.5, 3.2.1
- JDK Version: 1.8
- Container Version (If Applicable): any
Example Application
- TODO: link to github repository with example that reproduces the issue
if necessary i can create an example repo, but it is simple to reproduce