Loading...

XML

Word

Printable

Type: Suggestion
Resolution: Invalid
Fix Version/s: None
Component/s: None
Labels:
- affects-server
- security
Environment:

Hide
Operating System: Mac OS X 10.5.8
Java Version: 1.6.0_13
Java Vendor: Apple Inc.
JVM Version: 1.0
JVM Vendor: Sun Microsystems Inc.
JVM Impl Version: 11.3-b02-83
Java Runtime: Java(TM) SE Runtime Environment
Java VM: Java HotSpot(TM) 64-Bit Server VM
OS Architecture: x86_64
Database Type: MySQL
Database Driver: com.mysql.jdbc.Driver
Database Version: 76

Show
Operating System: Mac OS X 10.5.8 Java Version: 1.6.0_13 Java Vendor: Apple Inc. JVM Version: 1.0 JVM Vendor: Sun Microsystems Inc. JVM Impl Version: 11.3-b02-83 Java Runtime: Java(TM) SE Runtime Environment Java VM: Java HotSpot(TM) 64-Bit Server VM OS Architecture: x86_64 Database Type: MySQL Database Driver: com.mysql.jdbc.Driver Database Version: 76

NOTE: This suggestion is for JIRA Server. Using JIRA Cloud? See the corresponding suggestion.

We need to avoid Cross-site Scripting vulnerabilities. A function should be created to provide server side and client side input validation where applicable. Special characters should be stripped out during the validation process.
The following special characters should be stripped out if unnecessary:
[1] | (pipe sign)
[2] & (ampersand sign)
[3] ; (semicolon sign)
[4] $ (dollar sign)
[5] % (percent sign)
[6] @ (at sign)
[7] ' (single apostrophe)
[8] " (quotation mark)
[9] \' (backslash-escaped apostrophe)
[10] \" (backslash-escaped quotation mark)
[11] <> (triangular parenthesis)
[12] () (parenthesis)
[13] + (plus sign)
[14] CR (Carriage return, ASCII 0x0d)
[15] LF (Line feed, ASCII 0x0a)
[16] , (comma sign)
[17] \ (backslash)