Cross-site scripting vulnerability

Cross-site scripting vulnerability

Search
FrameMaker (2015 release) User Guide

On this page

Applies to: FrameMaker (2015 release) FrameMaker 12

某些 Creative Cloud 应用程序、服务和功能在中国不可用。

Issue: Published content is vulnerable to certain hacks by malicious users

If you publish your FrameMaker documents to the Responsive HTML5 output, the published content is vulnerable to certain hacks by malicious users.

It was found that a hacker can do any of the following from the published output:

  • Execute malicious code by entering the code in the browser URL of the published output
  • Store malicious URLs in the cookies that the published output creates
  • Display content from malicious URLs within the published output

Note:

The updates described in this article, will be available in the next FrameMaker patch.

Solution

To resolve this issue, do the following:

  1. Go to the following FrameMaker install location:

    FrameMaker 2015:
    <Drive>:\Program Files (x86)\Adobe\AdobeFrameMaker2015\fminit\publisher

    FrameMaker 12:
    <Drive>:\Program Files (x86)\Adobe\AdobeFrameMaker12\fminit\publisher

  2. Take backup of the following folder:

    • ResponsiveHelpExt

  3. Extract the contents from the attached archive.

    Download

    Get file
    FrameMaker 2015
    Get file
    FrameMaker 12

    The archive contains the following folder:

    • ResponsiveHelpExt

  4. Copy the extracted folder and paste it into the FrameMaker install directory specified in step 1.

    When you are prompted, click Yes to merge these folders with the existing folders.

  5. Regenerate the Responsive HTML5 output.

If you are using layouts already created from Theme Standard or Theme Black, the layout.js file described in the following steps needs to be updated in those layouts:

You need extract the contents of the .sts file associated with your Responsive HTML5 publish setting.

  1. Take a backup of your .sts file.

  2. Change the extension of the .sts file to .zip and extract the contents of the .zip file.

    The extracted folder contains a !ScreenLayout! folder that further contains one folder for each FrameMaker layout that you have used for this publish setting.

    Note: The layout folder name is based on your document name.

  3. Extract the following zip archive.

    Download

    Get file
    Layout folder

    The archive contains one the following folders:

    • theme_created_from_-Theme1_Standard-
      This folder contains the layout.js for the Standard theme
    • theme_created_from_-Theme3_Black-
      This folder contains the layout.js for the Black theme

  4. In your extracted folder (see Step 2 above), overwrite the layout.js in each of the corresponding layout folders.

  5. Create a zip archive of the contents of the extracted folder.

    Do not select and zip the extracted folder. Select the contents of the entire folder and zip the contents into a single zip file.

  6. Rename the .zip file to .sts.

  7. Regenerate the Resposive HTML5 output.