Application Accept Special Characters in Input Fields

Issue

• The application accepts special characters in input fields. Ex: " ' ` * ; % _ = & | \ ? ~ < > ^ () [] {} $ \n\
• Steps to Reproduce:
  1. Start Liferay server.
  2. Navigate to the user’s profile.
  3. Click on Account Settings.
  4. Edit the First Name field and enter: <script>alert("1")</script> test
  5. Click on Save. 
  
  Observed Behavior: The input is saved without triggering a pop-up, and the special characters are displayed as-is.
  Expected Behavior: It should show as a script alert (i.e., without any special characters and sanitized), or rejected with a validation error indicating that special characters are not allowed.

Environment

• Liferay DXP 7.4

Resolution

• To prevent cross-site scripting (XSS), user-submitted values are escaped on output. To support integration features, Liferay DXP doesn’t encode input. Data is stored in its original form as submitted by the user.
• Liferay stores these special characters securely. If the UI does not trigger any JS alerts, we can consider the product secure.
• Unless there’s a security risk where a name with special characters could cause potential harm or any pop-up, we believe that allowing any and all characters is our general policy for the name fields of a user.
• The reason we do this is because people’s names can be incredibly complex and can contain a range of characters that we may not be able to anticipate properly.
   
• As a basic example, the apostrophe would be considered a standard character to include in many names (e.g. Jeanne D’Arc, Chang’e, Shaquille O’Neal) as would the hyphen (e.g., Julia Louis-Dreyfus).
   
• However, we would also need to be mindful not to eliminate special characters that:

1. are used in stage names that are otherwise used as a person’s identifying name (e.g., A$AP Rocky)
2. any special characters that are used to represent specific sounds that otherwise are not properly represented; see rugby player Prince !Gaoseb, where the ! represents a clicking noise found in some African languages
3. special characters that are used in specific languages, such as the : which can be found in some First Nations names.

Additional Information

• Introduction-to-Securing-Liferay-DXP.