JR50423: USER INPUT RECEIVED VIA A COACH MIGHT CONTAIN ESCAPED SPECIAL CHARACTERS.

Download Version 8.0.1 Fix Pack 3 for the IBM Business Process Manager products
Version 8.5 Refresh Pack 6 for the IBM Business Process Manager products
Version 8.5.0 Fix Pack 2 for the IBM Business Process Manager products

APAR status

• Closed as program error.

Error description

• When a user provides input via a Coach, any special characters
  contained within that data are escaped (special characters are
  converted to their XML entity equivalents?for example, the <
  symbol is converted to &lt;). This is done as a security measure
   to guard against cross-site scripting attacks.
  This might pose a problem for the customer's application,
  depending on how that user input is used.
  
  PRODUCTS AFFECTED :
  IBM Business Process Manager (BPM) Advanced
  IBM BPM Standard
  IBM BPM Express
  

Local fix

• The workaround would be for the customer to code their own
  function to convert the XML entities back to their equivalent
  special characters.
  

Problem summary

• User input received via a coach might contain escaped special
  characters.
  

Problem conclusion

• A fix is available for IBM BPM V8.0.1.2 that introduces a new
  api unescapeHtml(String str) which returns a string not
  containing any escaped special characters.  This API is part of
  the tw.system namespace. The input is the string to unescape or
  null.
  
  This fix also introduces another api escapeHtml(String str)
  which returns a string with escaped special characters (if any).
  This API is also part of the tw.system namespace. The input is
  the string to escape of null.
  
  On Fix Central (http://www.ibm.com/support/fixcentral), search
  for JR50423:
  1.Select IBM Business Process Manager with your edition from the
  product selector, the installed version to the fix pack level,
  and your platform, and then click Continue.
  2.Select APAR or SPR, enter JR50423, and click Continue.
  When you download fix packages, ensure that you also download
  the readme file for each fix. Review each readme file for
  additional installation instructions and information about the
  fix.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  BPM ADVANCED

• Fixed component ID

  5725C9400

Applicable component levels

• R801 PSY

     UP