Fixed: fine tuned the sanitization of user input by allowing "safe" content;
thanks to Jacques for the suggestion.
Fixes CVE-2019-10073
@@ -777,6 +777,10 @@ under the License.
<attribute name="returnId" type="String" mode="IN" optional="true"/>
<attribute name="custRequestId" type="String" mode="IN" optional="true"/>
<attribute name="action" type="String" mode="IN" optional="true"/><!-- to indicate any special action like: REPLY, REPLYALL, FORWARD or empty for no special action-->
+ <override name="headerString" allow-html="safe"/>
+ <override name="content" allow-html="safe"/>
+ <override name="messageId" allow-html="safe"/>
+ <override name="subject" allow-html="safe"/>
</service>
<service name="createCommunicationEvent" engine="simple"
location="component://party/minilang/communication/CommunicationEventServices.xml" invoke="createCommunicationEventWithPermission" auth="true">
