Remove JSF example

I don't think we need this: there are lots of possible XSS vectors; we don't need to enumerate every one in the qhelp file.
This commit is contained in:
Chris Smowton
2021-09-14 11:31:49 +01:00
parent 76e4077b56
commit cca9ad06b4

View File

@@ -1,33 +0,0 @@
@FacesRenderer(componentFamily = "", rendererType = "")
public class JsfXSS extends Renderer
{
@Override
public void encodeBegin(FacesContext facesContext, UIComponent component) throws IOException
{
super.encodeBegin(facesContext, component);
Map<String, String> requestParameters = facesContext.getExternalContext().getRequestParameterMap();
String windowId = requestParameters.get("window_id");
ResponseWriter writer = facesContext.getResponseWriter();
writer.write("<script type=\"text/javascript\">");
writer.write("(function(){");
{
// BAD: directly output user input.
writer.write("dswh.init('" + windowId + "','"
+ "......" + "',"
+ -1 + ",{");
}
{
// GOOD: use the method `writeText` that performs escaping appropriate for the markup language being rendered.
writer.write("dswh.init('");
writer.writeText(windowId, null);
writer.write("','"
+ "......" + "',"
+ -1 + ",{");
}
writer.write("});");
writer.write("})();");
writer.write("</script>");
}
}