Escaping html tag to prevent xss

[hunterale]

📊 Metadata *

Bounty URL: https://www.huntr.dev/bounties/1-maven-xmppserver/

⚙️ Description *

In the page used to delete the group, the (dangerous) group name characters that can cause an XSS are transformed in a way the are not dangerous any more, preserving the correct name visualization of the group name

💻 Technical Description *

The XSS payload was printed in the html template without escaping/encoding the dangerous characters. The proposed fix uses a method in the StringUtil class (already present in the project) that HTML-escapes dangerous characters and the payload doesn't work any more

🐛 Proof of Concept (PoC) *

The screenshot shows the triggered XSS due to the printed payload (as is ) in the html of the page causing the xss at the opening of the page

🔥 Proof of Fix (PoF) *

The screenshot shows the payload of XSS is now HTML-escaped so the correct view of group name is preserved but the payload can create anymore a script context to trigger the XSS

👍 User Acceptance Testing (UAT)

After the fix, the page is still working correctly allowing the user to delete the desired group

[JamieSlome]

👋 Hello, @guusdk - @hunterale has opened a PR to us with a fix for a potential vulnerability in your repository. To view the vulnerability, please refer to the bounty URL in the first comment, above.

Ultimately, you get to decide if the fix is 👍 or 👎. If you are happy with the fix, please write a new comment (@huntr-helper - LGTM) and we will open a PR to your repository with the fix. All remaining PRs for this vulnerability will be automatically closed.

If you have any questions or need support, come and join us on our community Discord!

@guusdk & @hunterale - thank you for your efforts in securing the world’s open source code! 🎉