LPS-39762

Hi Ray,

I'm trying to prevent XSS in portletId, when portlet is executed.

The main security control here is to validate portletId in SecurityPortletContainerWrapper and deny to execute any portlet with invaild id.

But I haven't found how should valid portletId look like, there is no information in portlet spec. Only in XSD is that portlet-name is portlet:string:

"This is a special string datatype that is defined by JavaEE 
as a base type for defining collapsed strings. When 
schemas require trailing/leading space elimination as 
well as collapsing the existing whitespace, this base 
type may be used.
"

So it seems portletId may contain all characters except white space chars, I only found that we use insecure PortalImpl.getJsSafePortletId to get "safe" portletId. 

So I created a portal property (portlet.id.check.whitelist) to handle some special portlet ids and bypass this check.