bug fix for #75

factionsecurity · Oct 14, 2024 · c803850 · c803850
1 parent 458d992
commit c803850
Show file tree

Hide file tree

Showing 2 changed files with 16 additions and 16 deletions.
diff --git a/WebContent/WEB-INF/jsp/assessment/editVulnJSON.jsp b/WebContent/WEB-INF/jsp/assessment/editVulnJSON.jsp
@@ -2,21 +2,21 @@
 <%@ taglib prefix="s" uri="/struts-tags" %>
 <%@ page language="java" contentType="application/json; charset=UTF-8"
     pageEncoding="UTF-8"%>
-{ "name" : "<s:property value="current.name"/>",
+{ "name" : "<s:property value="current.name" escapeJavaScript="true"/>",
 "description" : "<s:property value="description"/>",
 "recommendation" : "<s:property value="recommendation"/>",
 "details" : "<s:property value="details"/>",
 "likelyhood" : "<s:property value="current.likelyhood"/>",
 "impact" : "<s:property value="current.impact"/>",
 "overall" : "<s:property value="current.overall"/>",
 "cf" : [<s:iterator value="current.CustomFields" status="stat"><s:if test="#stat.index!=0">,</s:if>{ "id" : ${id}, "typeid" : ${type.id}, "value" : "${value}"}</s:iterator>],
-"dfname" : "<s:property value="current.defaultVuln.name"/>",
+"dfname" : "<s:property value="current.defaultVuln.name" escapeJavaScript="true"/>",
 "dfvulnid" : "<s:property value="current.defaultVuln.id"/>",
-"dfcat" : "<s:property value="current.defaultVuln.category.name"/>",
+"dfcat" : "<s:property value="current.defaultVuln.category.name" escapeJavaScript="true"/>",
 "dfcatid" : "<s:property value="current.defaultVuln.category.id"/>",
 "catid" : "<s:property value="current.category.id"/>",
-"cvssScore" : "<s:property value="current.cvssScore"/>",
-"cvssString" : "<s:property value="current.cvssString"/>"
+"cvssScore" : "<s:property value="current.cvssScore" escapeJavaScript="true"/>",
+"cvssString" : "<s:property value="current.cvssString" escapeJavaScript="true"/>"
 }
 
 
diff --git a/WebContent/WEB-INF/jsp/remediation/vulnsJson.jsp b/WebContent/WEB-INF/jsp/remediation/vulnsJson.jsp
@@ -1,12 +1,12 @@
 <%@page import="org.apache.struts2.components.Include"%><%@ page language="java" contentType="application/json; charset=UTF-8"
     pageEncoding="UTF-8"%><%@ taglib prefix="s" uri="/struts-tags" %><% boolean first=true;%>{ "data" : [<s:iterator value="combos">
 <% if(first){ first=false;}else{ %>,<%}%>[ "<input class='remselect' type='checkbox' onclick='return false'/>",
-"<s:property value="vuln.name"/>" , 
+"<s:property value="vuln.name" escapeJavaScript="true"/>" , 
 "<s:property value="assessment.appId"/>\n<s:property value="assessment.name"/>", 
-"<s:iterator value="assessment.assessor"><s:property value="fname"/> <s:property value="lname"/>\n</s:iterator>",
-"<s:property value="vuln.tracking"/>" , 
+"<s:iterator value="assessment.assessor"><s:property value="fname" escapeJavaScript="true"/> <s:property value="lname" escapeJavaScript="true"/>\n</s:iterator>",
+"<s:property value="vuln.tracking" escapeJavaScript="true"/>" , 
 "<s:if test="isVer">Out for Verification</s:if>",
-"<s:property value="vuln.overallStr"/>" ,  
+"<s:property value="vuln.overallStr" escapeJavaScript="true"/>" ,  
 <s:if test="vuln.closed== null">
 "<s:date name="vuln.opened"  format="MM/dd/yyyy"/>",
 </s:if>
@@ -18,13 +18,13 @@
 {},
 { 
 	"aid" :"<s:property value="assessment.id"/>", 
-	"appId" :"<s:property value="assessment.appId"/>", 
+	"appId" :"<s:property value="assessment.appId" escapeJavaScript="true" />", 
 	"vid" : "<s:property value="vuln.id"/>", 
-	"dist" : "<s:property value="assessment.DistributionList"/>", 
+	"dist" : "<s:property value="assessment.DistributionList" escapeJavaScript="true"/>", 
 	"notes" : "<s:property value="assessment.AccessNotes"/>",
-	"name" : "<s:property value="assessment.name"/>",
-	"vulnName" : "<s:property value="vuln.name"/>",
-	"tracking" : "<s:property value="vuln.tracking"/>",
+	"name" : "<s:property value="assessment.name" escapeJavaScript="true"/>",
+	"vulnName" : "<s:property value="vuln.name" escapeJavaScript="true"/>",
+	"tracking" : "<s:property value="vuln.tracking" escapeJavaScript="true"/>",
 	"isVer" : ${isVer},
 	"severity" : {
 		"overall" :  "${vuln.overall}",
@@ -34,8 +34,8 @@
 	"reports": [<s:iterator value="reports" status="stat">
 	<s:if test="!#stat.first">,</s:if>
 	{	
-		"name": "<s:property value="assessment.name"/> - <s:property value="assessment.type.type"/> <s:if test="retest == true">Retest </s:if>Report.docx", 
-		"type": "<s:property value="assessment.type.type"/> <s:if test="retest == true">Retest</s:if>", 
+		"name": "<s:property value="assessment.name" escapeJavaScript="true"/> - <s:property value="assessment.type.type" escapeJavaScript="true"/> <s:if test="retest == true">Retest </s:if>Report.docx", 
+		"type": "<s:property value="assessment.type.type" escapeJavaScript="true"/> <s:if test="retest == true">Retest</s:if>", 
 		"updated": "<s:date name="gentime" format="MM-dd-yyyy hh:mm:ss"/>", 
 		"guid" : "<s:property value="filename"/>",
 		"isRetest": <s:property value="retest"/>