In the absence of a message string for the error code, this is the message that gets written as the error. So ObjectUtils class, nullSafeToString method parameter can contains XSS attack script value. So I added convertXSSValue method and testCase.
When the vaule contains script then the method converting the value safe.
Comment From: pivotal-issuemaster
@hangsublim Please sign the Contributor License Agreement!
Click here to manually synchronize the status of this Pull Request.
See the FAQ for frequently asked questions.
Comment From: pivotal-cla
@hangsublim Please sign the Contributor License Agreement!
Click here to manually synchronize the status of this Pull Request.
See the FAQ for frequently asked questions.
Comment From: snicoll
@hangsublim thanks for the PR but a generic method such as nullSafeToString can't do that kind of transformation as it could be used with trusted input and such change may not be welcome.