KocsisDaniel/liferay-portal — pull request #209 by vilmospapp (2013-01-03 08:15:42+00:00)
Title: [TECHNICAL SUPPORT] LPS-31642 fix XSS issue in membership request form

Hi Dani,

As @juliocamarero had a question about group.toEscapedModel() usage instead of HtmlUtil.escape() calls, I've retested this issue and found some places where the same thing causes XSS as well, and as they are strongly related to the original issue I fixed them as well. I still used the original approach in the fix with the HtmlUtil.escape() calls because the reason I mentioned in the comment of the pr at @juliocamarero. I discussed it with Shuyang and he said that if we really escape only 1-2 fields it is better for performance then using the escaped model verision, or we could use the escaped model, but pass it over to the other jsps (where it is used) in a parameter/attribute to clean up the code and not escape everywhere, but this later option would need a deeper refactoring of the code for this fix and extensive testing as well.

Further more, as we discussed, I removed the escapeXml setting from the header what you've added as the header will use escapeXml=true by default.

Regards,
Vilmos