SECURITY: XSS on 'View conditions for transition' page

[Ilya Zinoviev]

There is an XSS on 'View conditions for transition' page: failure message inputed by user is returned without escaping.

TC:

1. Add 'Boolean validator with math, date-time or text-string terms'
2. Fill 'Message to show when validation fails' field with '<script>alert(2)</script>' value
3. Save condition. (This brings you back to conditions table)
4. You've been XSS'ed

This can not be fixed by Atlassian because we want to give vendor ability to have formatted description.

[Fidel Castro Armario]

Thank you Ilya, the problem will be fixed in version 2.2.12.

[Fidel Castro Armario]

Fixed in just released version 2.2.12.

[Ilya Zinoviev]

Great! Thank you!