Project: mule
Issue MULE-6468: Messages generated from http-messages.properties should be escaped when returned to the client as http response
Currently if you send the the following http request: {code} GET /unionstation/ens/form HTTP/1.1 Accept: */* Accept-Language: en-us UA-CPU: x86 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322) Host: staging-unionstation.optuminsight.com Authorization: Pragma: no-cache Referer: https://staging-unionstation.optuminsight.com:443/unionstation/ens/form X-Scan-Memo: Category="Audit"; Function="createStateRequestFromAttackDefinition"; SID="CF1B85D9856FC7300BE04E08AE969344"; PSID="1D12AD7B110413DEBB8E6634539F76CF"; SessionType="AuditAttack"; CrawlType="None"; AttackType="HeaderParamManipulation"; OriginatingEngineID="1354e211- 9d7d-4cc1-80e6-4de3fd128002"; AttackSequence="3"; AttackParamDesc="Authorization"; AttackParamIndex="6"; AttackParamSubIndex="0"; CheckId="(null)"; Engine="Cross+Site+Scripting"; Retry="False"; SmartMode="NonServerSpecificOnly"; AttackString="%3csCrIpT%3ealert(88585)%3c%2fsCrIpT%3e"; AttackStringProps="Attack"; Connection: Keep-Alive Cookie: CustomCookie=WebInspect76158ZX7B636566555940D48015FD4B8FB9C0F6Y76AF UnitedHealth Group 5Report Date: 9/28/2012 Vulnerability (Legacy) {code} you will receive the following response: {code} HTTP/1.1 403 Forbidden Date: Thu, 27 Sep 2012 07:55:26 GMT Server: Mule Core/3.3.0 http.status: 403 X-MULE_ENCODING: UTF-8 WWW-Authenticate: Basic realm="X12Files" Content-Type: text/plain; charset=UTF-8 Content-Length: 116 Connection: close Http Basic filter doesnt know how to handle header . Message payload is of type: String {code} containing potential malicious javascript code that the browser will run. Anytime a message is returned to the client the inputs should be parsed to prevent this kind of problems
Story points: 8