GHSA-vh22-6c6h-rm8q jte's HTML templates containing Javascript template strings are subject to XSS

• Maven gg.jte:jte: < 3.1.16 → fixed in 3.1.16 • Maven gg.jte:jte-runtime: < 3.1.16 → fixed in 3.1.16

Summary Jte HTML templates with `script` tags or script attributes that include a Javascript template string (backticks) are subject to XSS. Details The `javaScriptBlock` and `javaScriptAttribute` methods in the `Escape` class (source) do not escape backticks, which are used for Javascript template strings. Dollar signs in template strings should also be escaped as well to prevent undesired interpolation. PoC 1. Use the Jte Gradle Plugin with the following code in `src/jte/xss.jte`: ```html @param String someMessage XSS Test window.someVariable = `${someMessage}`; XSS Test ``` 2. Use the following Java code to demonstrate the XSS vulnerability: ```java final StringOutput output = new StringOutput(); JtexssGenerated.render(new OwaspHtmlTemplateOutput(output), null, "` + alert(`xss`) + `"); renderHtml(output); ``` Impact HTML templates rendered by Jte's `OwaspHtmlTemplateOutput` in versions less than or equal to `3.1.15` with `script` tags or script attributes that contain Javascript template strings (backticks) are vulnerable.