cloudfoundry-incubator/admin-ui — pull request #99 by jackfengibm (2014-08-05 00:57:09+00:00)
Title: fixed js script injection bug

Some CF components such as organizations, spaces, apps, service plans and etc depend on user inputs for their names. Prior to this PR, admin-ui directly renders these inputs almost without any safeguard measure. This behavior allows malicious users to deliberately embed JavaScript programs in these names. When rendering these user inputs on the main tables, browser can trigger invocation of these embedded programs which can cause annoyance or even harms to the admin-ui's end users. This problem is known as Javascript injection. This PR aims at addressing this security problem.

As a fix, the display logic on the main tables now removes all embedded HTML tags from user inputs. The rendering logic for detail tables preserves these user inputs unless they are used in the clickable links. This measure stop the Javascript injection attach while preserving the originality of user inputs as viewable in the details tables.