This SAP Note describes how to reduce the risk of possible cross-site scripting (XSS) attacks in JSF.
There are two precautions already in place at SAP for XSS prevention in JSF applications, namely the ICM filter mechanism and the SAP component library for JSF.
o ICM filter mechanism
o SAP component library for JSF
The SAP component library for JSF (a. k. a. Light Speed Faces library, LSF) already has built-in support to protect against XSS: By means of the Unified Rendering in LS, the LSF library offers “escaped” (i. e. output encoded), and thus secure counterparts of the writeAttribute methods in Sun’s reference implementation.
Available fix and Supported packages
- J2EE-FRMW | 7.10 | 7.11
Detailed vulnerability information added to RedRays Security Platform. Contact [email protected] for details.