-
Type: Bug
-
Status: Resolved
-
Priority: Minor
-
Resolution: Fixed
-
Affects Version/s: 5.5.0-HF12, 5.6
-
Fix Version/s: 5.4.2-HF31, 5.5.0-HF17, 5.6.0-HF06, 5.7.1
-
Component/s: Dashboard / OpenSocial (deprecated)
This new bug was introduced by NXP-9765. a few calls to escapeString were added, but no check to ensure the field is really a string is done. The result is that null values on a document properties generates a javascript exception and stops the loading of the gadget in the gadgets.util.escapeString() calls.
I'd expect some type casting if escapeString is to be used like follows, which would provide the same behaviour as before:
html += gadgets.util.escapeString(String(dashBoardItem.title));
- depends on
-
NXP-9765 Prevent XSS in gadgets
- Resolved