# XSS Attack Prevention

**URL:** <https://community.sonarsource.com/t/xss-attack-prevention/8175>\
**Category:** SonarQube Server / Community Build\
**Created:** [March 27, 2019, 11:13am UTC](https://community.sonarsource.com/t/xss-attack-prevention/8175 "2019-03-27T11:13:43Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![George\_Knight](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/george_knight/32/3188_2.png) [@George\_Knight](https://community.sonarsource.com/u/George_Knight)\
**Post date:** [March 27, 2019, 11:13am UTC](https://community.sonarsource.com/t/xss-attack-prevention/8175/1 "2019-03-27T11:13:43Z")

</div>

Hi,

We’ve detected a possible security issue in SonarQube.

Repro steps:

1. Go to Administration \> Configuration \> General Settings.

2. Enter in “About page text” field: aaa ![]()bbb  
 ![image](https://europe1.discourse-cdn.com/sonarsource/uploads/sonarcommunity/original/2X/a/acba93e98d6d9075c68239fff53781cc43ec9493.png)

3. Go to about page. JavaScript message is shown.  
 ![image](https://europe1.discourse-cdn.com/sonarsource/uploads/sonarcommunity/original/2X/3/3c1d306a865a06ad46706429943365ead27c4ce3.png)

- which versions are you using (SonarQube 7.3.0.15553)
- what are you trying to achieve (Deploy a SonarQube PoC environment to evaluate SonarQube services)

Does SonarQube implement XSS Attack Prevention at code level?

---

<div class="post-metadata">

**Author:** ![ganncamp](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/ganncamp/32/1261_2.png) [@ganncamp](https://community.sonarsource.com/u/ganncamp)\
**Post date:** [March 27, 2019, 11:51am UTC](https://community.sonarsource.com/t/xss-attack-prevention/8175/5 "2019-03-27T11:51:09Z")

</div>

Hi,

Thanks for taking the time to report this. In fact, it was identified previously through our own testing procedures, but since only SonarQube administrators can set this property we’ve determined that as a practical matter it’s not a risk. Does this make sense?

&nbsp;  
Ann

---

<div class="post-metadata">

**Author:** ![George\_Knight](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/george_knight/32/3188_2.png) [@George\_Knight](https://community.sonarsource.com/u/George_Knight)\
**Post date:** [March 29, 2019, 4:34pm UTC](https://community.sonarsource.com/t/xss-attack-prevention/8175/6 "2019-03-29T16:34:05Z")

</div>

Hi Ann,

Thank so much for replying. Yeah, it makes sense for me.

Regards,

---

<div class="post-metadata">

**Author:** ![DanielRuf](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/danielruf/32/3168_2.png) [@DanielRuf](https://community.sonarsource.com/u/DanielRuf)\
**Post date:** [April 1, 2019, 4:47am UTC](https://community.sonarsource.com/t/xss-attack-prevention/8175/7 "2019-04-01T04:47:36Z")

</div>

Hi, I fail to see how this is practical as this can be abused by attackers.

Also I wonder if there is a (responsible) disclosure workflow as vulnerabilities should not be discussed in the public normally.

---

<div class="post-metadata">

**Author:** ![Alexandre\_Gigleux](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/alexandre_gigleux/32/26_2.png) [@Alexandre\_Gigleux](https://community.sonarsource.com/u/Alexandre_Gigleux)\
**Post date:** [April 12, 2019, 9:11am UTC](https://community.sonarsource.com/t/xss-attack-prevention/8175/9 "2019-04-12T09:11:26Z")

</div>

Hello,

That’s a valid point. We have a responsible disclosure workflow for SonarSource’s customers and we will adapt it to make it available for community users.  
I will come back to this thread once it is published.

Regards

---

<div class="post-metadata">

**Author:** ![Alexandre\_Gigleux](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/alexandre_gigleux/32/26_2.png) [@Alexandre\_Gigleux](https://community.sonarsource.com/u/Alexandre_Gigleux)\
**Post date:** [May 2, 2019, 7:09am UTC](https://community.sonarsource.com/t/xss-attack-prevention/8175/10 "2019-05-02T07:09:15Z")

</div>

Hello @DanielRuf,

Our [Responsible Vulnerability Disclosure](https://community.sonarsource.com/t/responsible-vulnerability-disclosure/9317) policy has been published.

Thanks