Error message while testing Cross-Site scripting nonce parameter.

[pki-bot]

This issue was migrated from Pagure Issue #2315. Originally filed by akahat@redhat.com (@amolkahat) on 2016-05-04 20:24:55:

• Assigned to nobody
• Associated bugzillas
  • https://bugzilla.redhat.com/show_bug.cgi?id=1317394

---

After execution of following URL got unrecoverable error message.

Steps to Reproduce:

1. Authenticate with a CA agent certificate.
2. The following url is being used to test Cross-Site Scripting nonce
parameter.
3. In the browser paste the following url with your CA's host and agent port.

https://hostname:<secure-port>/ca/agent/ca/profileProcess?requestId=%20%2b%20re
questId%20%2b%20&' + recordSet[i].defListSet[j].defId +
'='%20%2b%20escapeValue(recordSet%5bi%5d.defListSet%5bj%5d.defVal)%20%2b%
20'&' + recordSet[i].defListSet[j].defId + '='%20%2b%20recordSet%5bi%
5d.defListSet%5bj%5d.defVal%20%2b%20'&' + recordSet[i].defListSet[j].defId +
'='%20%2b%20recordSet%5bi%5d.defListSet%5bj%5d.defVal%20%2b%20'&' +
recordSet[i].defListSet[j].defId + '='%20%2b%20recordSet%5bi%5d.defListSet%
5bj%5d.defVal%20%2b%20'&' + recordSet[i].defListSet[j].defId + '=%20%2b%20c%
5bk%5d%20%2b%20&' + recordSet[i].defListSet[j].defId +
'=false&requestNotes='%20%2b%20requestNotes%20%2b%20'&op=unassign&nonce=
%5c%22%22%3c%73%43%72%49%70%54%3e%61%6c%65%72%74%28%35%31%32%31%33%29%3c%2f%
73%43%72%49%70%54%3e&submit=submit

Actual results:

The Certificate System has encountered an unrecoverable error.

Error Message:

java.lang.NumberFormatException: Illegal embedded sign character

Please contact your local administrator for assistance.

Expected Results:

Request Information
===============================================
| Error Code:       | 1                       |
===============================================
| Error Reason:     | Operation Not Found     |
===============================================

[pki-bot]

Comment from mharmsen (@mharmsen) at 2016-05-04 20:26:57

Per Bug Triage of 05/03/2016: 10.4

NOTE: Discussed and confirmed with aakkiang over IRC.

[pki-bot]

Comment from akahat@redhat.com (@amolkahat) at 2017-02-27 14:00:09

Metadata Update from @amolkahat:

• Issue set to the milestone: UNTRIAGED

[pki-bot]

Comment from mharmsen (@mharmsen) at 2017-09-02 10:35:23

Metadata Update from @mharmsen:

• Custom field feature adjusted to None
• Custom field proposedmilestone adjusted to None
• Custom field proposedpriority adjusted to None
• Custom field reviewer adjusted to None
• Custom field version adjusted to None
• Issue close_status updated to: None
• Issue set to the milestone: FUTURE (was: UNTRIAGED)

[pki-bot]

Comment from mharmsen (@mharmsen) at 2018-04-16 20:38:01

Metadata Update from @mharmsen:

• Issue priority set to: minor (was: major)
• Issue set to the milestone: 10.6 (was: FUTURE)