This repository was archived by the owner on Jan 30, 2019. It is now read-only.
This repository was archived by the owner on Jan 30, 2019. It is now read-only.
[sec] Attacker could load own helpset #36
Metadata
Metadata
Assignees
Type
Fields
No fields configured for issues without a type.
javax.help.tagext.ValidateTag allows to provide the url to the hsName by a reqeust parameter, if no hsName is provided in the code an attacker could provide a link to some helpSet he controls and load it into any website.
The request parameter helpset has to be validated before using it.