# \#xss

**URL:** https://talk.openmrs.org/tag/xss/154.md

[Latest](https://talk.openmrs.org/latest.md) · [Categories](https://talk.openmrs.org/categories.md) · [Tags](https://talk.openmrs.org/tags.md)

---

## [Special characters HTML encoded in Form Builder JSON after Bahmni-Lite 1.0.2 upgrade. Breaks form conditions and login](https://talk.openmrs.org/t/special-characters-html-encoded-in-form-builder-json-after-bahmni-lite-1-0-2-upgrade-breaks-form-conditions-and-login/49998)

<div class="topic-metadata">

**Author:** [@thomasrod](https://talk.openmrs.org/u/thomasrod)\
**Replies:** 1\
**Last updated:** [August 27, 2026, 4:07am UTC](https://talk.openmrs.org/t/special-characters-html-encoded-in-form-builder-json-after-bahmni-lite-1-0-2-upgrade-breaks-form-conditions-and-login/49998 "2026-08-27T04:07:18Z")

</div>

Hello, I recently upgraded from Bahmni-Lite 1.0.0 to 1.0.2 to address CVE-2026-15477. Since the upgrade, I’m running into two issues related to special character handling: 1. Form Conditions get HTML-encoded In Form B…

---

## [Some vulnerabilites disclosed in 2014 still not resolved](https://talk.openmrs.org/t/some-vulnerabilites-disclosed-in-2014-still-not-resolved/13685)

<div class="topic-metadata">

**Author:** [@r0bby](https://talk.openmrs.org/u/r0bby)\
**Replies:** 0\
**Last updated:** [October 9, 2017, 10:19pm UTC](https://talk.openmrs.org/t/some-vulnerabilites-disclosed-in-2014-still-not-resolved/13685 "2017-10-09T22:19:58Z")

</div>

It is quite disheartening to see that a good number of issues related to security vulnerabilities, some of which have an assigned CVE have not been taken seriously. These should have been fixed within a couple weeks …

---

## [Strategy for dealing with XSS](https://talk.openmrs.org/t/strategy-for-dealing-with-xss/8946)

<div class="topic-metadata">

**Author:** [@isears](https://talk.openmrs.org/u/isears)\
**Replies:** 2\
**Last updated:** [December 2, 2016, 12:03am UTC](https://talk.openmrs.org/t/strategy-for-dealing-with-xss/8946 "2016-12-02T00:03:52Z")

</div>

I have implemented two versions of xss sanitization for issue RA-452 (persistent xss in patient registration address field) in my fork: 1.) Controller-implemented, in the registration app (RegisterPatientFragmentControl…

---

## [Use OWASP Encoder for XSS attacks](https://talk.openmrs.org/t/use-owasp-encoder-for-xss-attacks/4000)

<div class="topic-metadata">

**Author:** [@ttcphilips](https://talk.openmrs.org/u/ttcphilips)\
**Replies:** 17\
**Last updated:** [January 3, 2016, 1:29pm UTC](https://talk.openmrs.org/t/use-owasp-encoder-for-xss-attacks/4000 "2016-01-03T13:29:47Z")

</div>

Hi, I am a newbie to openmrs and would like to contribute. I found this \[1\] at issue-tracker. The org.apache.commons.lang.StringEscapeUtils is also a solution for this. But there are some issues which are introduce in \[…

---

## [Should we prevent XSS attacks for forms?](https://talk.openmrs.org/t/should-we-prevent-xss-attacks-for-forms/1405)

<div class="topic-metadata">

**Author:** [@approce](https://talk.openmrs.org/u/approce)\
**Replies:** 2\
**Last updated:** [March 16, 2015, 12:52am UTC](https://talk.openmrs.org/t/should-we-prevent-xss-attacks-for-forms/1405 "2015-03-16T00:52:17Z")

</div>

Few minutes ago I almost crashed one of the demo page by simple XSS script. Current validators provide possibility to perform not only XSS but SQL injection in perspective too. To avoid this troubles can we add regexp v…