Scada-LTS
Scada-LTS copied to clipboard
Fixed XSS vulnerabilities in graphical view components
Describe the bug This issue reports about XSS vulnerabilities found in graphical view components. For tests we were using project from this file: Scada-LTS-test-2669.zip
List of bugs
- [x] In
Enchanced image chart
, add data point to chart, alert->"virutal ds" && alert->"Point details -> Name" - [ ] In
Button script
, Text = => alert->"abc" - [ ] In
Simple Point
, Edit graphical render => Display point name = true, Style attribute = => alert->"Point details -> Name" - [ ] In
Simple compound
, Name = => alert->abc
All alerts appear when graphical view component is loaded.
Expected behavior All fields that had any and displayed alert, should be escaped and treated as string.
Desktop:
- OS: Linux Mint
- Browser: Chrome
- Version: <= 2.7.5.4
#2116