execution of javascript from filename

2013-09-16T11:11:31
ID ATLASSIAN:CONFSERVER-30802
Type atlassian
Reporter bernd.lindner
Modified 2018-10-11T08:37:34

Description

Steps to replicate:

Add an attachment

Rename the file to "<iframe onload=alert(1)>.txt"

Copy its remove link and open the link in a new browser window

Result: The JavaScript code is executed, rather than showing the "proceed w/ deletion" screen.

Everything works normally if you just click the delete button rather than copying the link into a new tab.