How to escape characters in ofbiz display-entity | XSS in Ofbiz

问题

Ofbiz form: Need to escape characters from description column in a display-entity tag to avoid XSS attacks:

<display-entity entity-name="Table" description="${description}" >

I tried to use bsh, as following:

<display-entity entity-name="Table" description="${bsh: org.apache.commons.lang.StringEscapeUtils.escapeHtml(&quot;${description}&quot;)}">

But I get this error:

Error rendering screen [component://my/widget/CommonScreens.xml#GlobalDecorator]: java.lang.IllegalStateException: This object has been flagged as immutable (unchangeable), probably because it came from an Entity Engine cache. Cannot set a value in an immutable entity object. 
(This object has been flagged as immutable (unchangeable), probably because it came from an Entity Engine cache. Cannot set a value in an immutable entity object.)

Exists a solution here to escape chars in description?

回答1:

There is no XSS issue there as explained at https://issues.apache.org/jira/browse/OFBIZ-6506 So no needs to escape, it's automatically done by OFBiz

回答2:

We recently committed a patch for this XSS vulnerability to Scipio ERP (an ofbiz fork):

https://github.com/ilscipio/scipio-erp/commit/cf7e8ef40af06e2903fb50a3f708a455ffd88c2a

It may be worth checking it out (www.scipioerp.com).

来源：https://stackoverflow.com/questions/30708500/how-to-escape-characters-in-ofbiz-display-entity-xss-in-ofbiz