Does it work on the newest released PrimeFaces version? No
Does it work on the newest sources in GitHub? No
Affected browsers: all
2) Expected behavior
Proper escaping of title referenced by p:tooltip for .
3) Actual behavior
Target title not escaped in tooltip.js if this.cfg.target is set in tooltip.js.
4) Steps to reproduce
5) Sample XHTML
<p:inputText id="focus" title="This tooltip is displayed when input gets the focus<script>alert('xss');</script>" />
<p:tooltip id="toolTipFocus" for="focus" showEvent="focus" hideEvent="blur" />
6) Sample bean
7) Solution
This error was fixed for the bindGlobal function in tooltip.js with #4394. Same solution should be applied to Function bindTarget.
The line
this.cfg.escape = (this.cfg.escape === undefined) ? true : this.cfg.escape;
must be added at top of bindTarget.
The text was updated successfully, but these errors were encountered:
javax.servlet.ServletException: javax.servlet.ServletException: Error Parsing /test.xhtml: Error Traced[line: 14] The value of attribute "title" associated with an element type "p:inputText" must not contain the '<' character.
But if I make it...
<p:inputTextid="focus"title="This tooltip is displayed when input gets the focus<script>alert('xss');</script>" />
<p:tooltipid="toolTipFocus"for="focus"showEvent="focus"hideEvent="blur" />
Then I can reprorduce it with this reproducer. pf-5642.zip
1) Environment
2) Expected behavior
Proper escaping of title referenced by p:tooltip for .
3) Actual behavior
Target title not escaped in tooltip.js if this.cfg.target is set in tooltip.js.
4) Steps to reproduce
5) Sample XHTML
<p:inputText id="focus" title="This tooltip is displayed when input gets the focus<script>alert('xss');</script>" />
<p:tooltip id="toolTipFocus" for="focus" showEvent="focus" hideEvent="blur" />
6) Sample bean
7) Solution
This error was fixed for the bindGlobal function in tooltip.js with #4394. Same solution should be applied to Function bindTarget.
The line
this.cfg.escape = (this.cfg.escape === undefined) ? true : this.cfg.escape;
must be added at top of bindTarget.
The text was updated successfully, but these errors were encountered: