openmrs/openmrs-core — pull request #451 by MrMarvin (2013-11-16 01:04:51+00:00)
Title: Trunk 3940 xss in concepts

This bunch of commits should fix TRUNK-3949 and a lot more XSS vulnerabilities altogether.

* Adds some `c:out` tags around String type attributes of Concept and related models
* adds implicit HTML escaping for `openmrs:format` method for concepts + a new unit test for that
* enables global html escaping for JSPs. This wasn't done before because it used to break a lot of on-purpose html outputs. However, these uses have been modified to be excepted by specifying `htmlEscape="false"`.

To be honest, I am not 100% sure if this does not influence someone else code in non-core modules but personally I think the white-listing vs. try-to-blacklist-everythingis the right way to go, especially from a security point of view!