Shiro Plugin

• Type: Improvement
• Status: Resolved
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: None
• Fix Version/s: 1.1
• Component/s: None
• Labels:

  None
• Environment:

  All

The principal tag in the JSecurity plugin isn't HTML encoded and therefore vulnerable to XSS attacks.

A fix would be to call encodeAsHTML on the result in the JsecTagLib

Originally reported to mailing list: http://markmail.org/message/gmsknbpu7xzz65vg

• Assignee:

  Peter Ledbrook

  Reporter:

  Angus Roberts

• Created:

  27/Nov/08 5:40 AM

  Updated:

  25/Mar/11 2:43 AM

  Resolved:

  24/Oct/10 12:37 PM