XSS in triStateCheckbox

[cnsgithub]

1) Environment

• PrimeFaces version: 6.3-snapshot

2) Expected behavior

Proper escaping of attributes stateOneTitle, stateTwoTitle, stateThreeTitle.

3) Actual behavior

The mentioned attributes are not escaped at all.

4) Steps to reproduce

Modify first p:triStateCheckbox of showcase to
<p:triStateCheckbox value="#{triStateCheckboxView.value1}" stateOneTitle="&quot; onmouseover=&quot;alert('stateOneTitle xss');&quot; " stateTwoTitle="&quot; onmouseover=&quot;alert('stateTwoTitle xss');&quot; " stateThreeTitle="&quot; onmouseover=&quot;alert('stateThreeTitle xss');&quot; "/>

Hovering first checkbox will trigger alert box.

5) Sample XHTML

see above

6) Sample bean

showcase

[cnsgithub]

@tandraschko Could you please add the security label? Thanks.

Pull request: #3773. Please carefully read the PR comment.

[cnsgithub]

Ah okay, @Rapster is a member now and also may add those labels. 😉