[TIME-135] XSS issues in the time sheet & pivot report gadgets

One of the JIRA Studio support engineers discovered some XSS vulnerabilities in the gadgets provided by the JIRA Timesheet Plugin:

Change a user's fullname to something/><script>alert("user fullname -username");</script>
Add the Timesheet gadget to a dashboard
Configure it to show info from the above user

This should be fixed by ensuring that all values that are substituted into Velocity templates are HTML-encoded.

One convenient way to do that is to use the Atlassian Template Renderer plugin to invoke Velocity rather than using VelocityManager directly. ATR automatically encodes any interpolation that isn't marked as HTML-safe. It works similarly to Confluence anti-XSS mode: http://confluence.atlassian.com/display/CONFDEV/Anti-XSS+documentation

Docs on ATR:

By tmoore/Tim Moore on Thu, 17 Feb 2011 21:00:33 -0800

Comments (3)