diff --git a/framework/webapp/src/main/java/org/apache/ofbiz/webapp/view/HttpViewHandler.java b/framework/webapp/src/main/java/org/apache/ofbiz/webapp/view/HttpViewHandler.java index 186c2caefe1..a6ac7dc3ccc 100644 --- a/framework/webapp/src/main/java/org/apache/ofbiz/webapp/view/HttpViewHandler.java +++ b/framework/webapp/src/main/java/org/apache/ofbiz/webapp/view/HttpViewHandler.java @@ -28,6 +28,7 @@ import org.apache.ofbiz.base.util.Debug; import org.apache.ofbiz.base.util.HttpClient; import org.apache.ofbiz.base.util.HttpClientException; +import org.apache.ofbiz.base.util.UtilCodec; import org.apache.ofbiz.base.util.UtilValidate; import org.apache.ofbiz.webapp.control.ConfigXMLReader; @@ -67,8 +68,13 @@ public void render(String name, String page, String info, String contentType, St HttpClient httpClient = new HttpClient(page); String pageText = httpClient.get(); - // TODO: parse page and remove harmful tags like , , , etc - look into the OpenSymphony piece for an example - response.getWriter().print(pageText); + // Sanitize the retrieved HTML content using the configured OFBiz HTML encoder/sanitizer + String sanitizedPageText = UtilCodec.getEncoder("html").sanitize(pageText, null); + + // Explicitly enforce the standard OFBiz permissive HTML policy to guarantee XSS-safe markup rendering + sanitizedPageText = UtilCodec.HtmlEncoder.PERMISSIVE_POLICY.sanitize(sanitizedPageText); + + response.getWriter().print(sanitizedPageText); } catch (IOException e) { throw new ViewHandlerException("IO Error in view", e); } catch (HttpClientException e) {