AntiSamy Liferay 7.0

RE: AntiSamy Liferay 7.0

2020-02-05T08:01:31Z

Hi,
Finally, the theme was right but the problems was in our ADT to print the breadcrumb. I saw that in the breadcrumb's ADT of liferay, the title was escaped manually and in ours ADT i didn´t do it.

Using the htmlUtil.escape() method when I print the breadcrumbs title , the problem was solved.Now, I have the same vulnerability in our web content custom templates. I thougth that the antisamy property should do this task, but I tried several configurations and none works like i wish.

Have I to escape manually all the custom fileds in all of my custom templates with the method htmlUtil or there is any configuration to escape the values of the fields of my custom templates?

Kind regards,

Iñigo

RE: AntiSamy Liferay 7.0

2020-01-16T09:00:09Z

Hi,

I've found that this problem occurs only wiht my custom theme.

If I set the classic theme of liferay or other custom theme develop by me, the antisamy works properly.

Anyone has any idea of what can have my theme for what the antisamy is not working??

Kind regards,

Iñigo

RE: AntiSamy Liferay 7.0

2020-01-10T09:14:10Z

Ah, ok. Have you tried to contact the support? They should help you better, they know your environment and have the bandwith to help you. Thanks!

RE: AntiSamy Liferay 7.0

2020-01-09T11:17:13Z

Sorry Tomas,
I wasn't precise about the version i'm using, is not community, is DXP.
Particulary, is the next version:

Liferay 7 DXP, build number: 7010
FixPaxk: 88-7010.

RE: AntiSamy Liferay 7.0

2020-01-09T10:50:05Z

Hi,
I couldn't reproduce it on 7.0 GA3. Maybe it's fixed?
Btw. 7.0 is very outdated community version, I strongly recommend to upgrade, there were more serious issues than just XSS, look at https://portal.liferay.dev/learn/security/known-vulnerabilities.
Sincerely,
-- tom +

AntiSamy Liferay 7.0

2020-01-09T09:24:19Z

Hi, I have a security vulnerability about cross site scripting (XSS stored) in the liferay forum portlet (com_liferay_message_boards_web_portlet_MBPortlet).

I've been searching a solution in the web and i've fount the following link in liferay documentation about antiSamy.
https://portal.liferay.dev/docs/7-0/deploy/-/knowledge_base/d/antisamy

I've configured the antiSamy like link said in order to cannot put script tags in the forums fields:

Whitelist = *
Blacklist = com.liferay.message.boards.*

Besides, i've checked the sanitizer-configuration.xml file and the script tag is inside with the "remove" action.

Can I avoid the user use script tags in the creation of new forum thread or new forum category?

The test i've made is tu put <script>alert("xss")</script> in category name and when i open this category, the alert show up.

Kind regards,

Íñigo