nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

As we transition to the new Hyland Community, some post links may be temporarily disrupted as we finalize redirects. We apologize for the inconvenience and are working to resolve this as quickly as possible. Details.

Cross Site Scripting Attacks

ahamed_rasmi

Hi,

We need to get approval for Security team before application be rolled out.

When we sought approval, they concluded Alfresco Share is prone to Cross Site Scripting Attacks…

I need help to overcome this issue and get the things going..

Ver: Alfresco 3.3
Browser: IE7..

Thanks in Advance

Find more posts tagged with

Comments

mikeh

If you've found a reproducible bug, the correct place to log it is JIRA (see the link in my signature below).

Thanks,
Mike

ahamed_rasmi

I posted in JIRA.. It was accepted.. But not accessible..

May i know the reason mike..? ALF-2623 is the code..

Regards,

Ahamed Rasmi

mikeh

Generally, if an XSS or similar security issue has been identified and is reproducible, we set the JIRA issue to be accessible by Alfresco staff only - that way it's not "Googleable".

Thanks,
Mike

ahamed_rasmi

Ok.. then how would i know about the status… and possible solutions..

Do you think UrlRewrite way with regex would solve this issue?

Regards

Ahamed

ahamed_rasmi

I have fixed the issue.. now share site is safe..

Added a Filter..

In filter replaced the uri parameter letters like <,> into different letters.. So script tag is not executed..

Issue considered as closed..

Regards,

Ahamed