XSS cross scripting context.restrictedTraverse

[olpat]

considere two zope folders:
one-----
           |
           two |

In folder one i have a python script that use:

fold_one=context.restrictedTraverse('/one')

with a parameter id in the parameter list:

I can retrieve two with this:

fold_two=fold_one [id] when i submit in my browser:

http://mysite.com/one/pythonscript?id='two'

but i can make a crossscripting attempt with:

http://mysite.com/one/pythonscript?id=<script>alert('XSS attempt')</script>
I have verified this in zope 2.11.4, zope 2.9.6

[olpat (briguetp)]

you don't have to return anything from the script. Only the line:
fold_two=fold_one[id]
returns a page with the javascript code.

[Hanno Schlichting (hannosch)]

Indeed, you shouldn't take untrusted data like query strings and use them unconditionally in your code. Proper quoting in your script is in order here.