CVE-2025-62263

@@ -3618,6 +3618,83 @@ definition {
 		}
 	}
 
+	@description = "Automation for LPS-199518. This ticket is about XSS. Role and Organization data should be escaped and rendered as a string."
+	@priority = 5
+	test CanViewRoleAndOrganizationsPrintedAsScript {
+		property portal.acceptance = "true";
+
+		task ("Given an account with a Role as a script and an user") {
+			JSONAccountEntry.addAccountEntry(
+				accountEntryName = "A1",
+				accountEntryType = "Business");
+
+			Account.openAccountsAdmin();
+
+			LexiconEntry.gotoEntry(rowEntry = "A1");
+
+			var scriptRole = '''My title<script>confirm("compromised")</script>''';
+			var scriptOrg = '''My org1<script>confirm("compromised")</script>''';
+
+			Account.addOwnedAccountRole(accountRoleTitle = ${scriptRole});
+
+			Account.openAccountsAdmin();
+
+			JSONUser.addUser(
+				userEmailAddress = "U1@liferay.com",
+				userFirstName = "U1fn",
+				userLastName = "U1ln",
+				userScreenName = "U1sn");
+		}
+
+		task ("And assign the user to the new account and a role") {
+			LexiconEntry.gotoEntry(rowEntry = "A1");
+
+			Account.assignUsers(
+				accountName = "A1",
+				assigneeName = "U1fn");
+
+			Account.addAssigneeToRoleViaUsersTab(
+				accountRoleTitle = ${scriptRole},
+				accountUserName = "U1fn U1ln");
+		}
+
+		task ("Then check that the Account role is rendered as a string") {
+			AssertTextEquals(
+				key_columnName = "lfr-account-roles-column",
+				key_rowEntry = "U1fn U1ln",
+				locator1 = "ContentRow#ENTRY_CONTENT_ROW_NUMBER_TD",
+				value1 = ${scriptRole});
+		}
+
+		task ("And given a new organization with a title as a script") {
+			JSONOrganization.addOrganization(organizationName = ${scriptOrg});
+		}
+
+		task ("And add the organization to the new account") {
+			Account.openAccountsAdmin();
+
+			LexiconEntry.gotoEntry(rowEntry = "A1");
+
+			Account.assignOrganizations(
+				accountName = "A1",
+				assigneeName = ${scriptOrg});
+		}
+
+		task ("Then check that the Organizations name assigned to the new account is rendered as a script") {
+			Account.openAccountsAdmin();
+
+			AssertTextEquals(
+				key_columnName = "lfr-organizations-column",
+				key_rowEntry = "A1",
+				locator1 = "ContentRow#ENTRY_CONTENT_ROW_NUMBER_TD",
+				value1 = ${scriptOrg});
+		}
+
+		JSONUser.tearDownNonAdminUsers();
+
+		Organization.tearDownCP(orgName = ${scriptOrg});
+	}
+
 	@description = "This tests canceling account creation will not save it."
 	@priority = 4
 	test ClickingCancelOrBackWillNotSaveAccount {

@@ -41,13 +41,13 @@ renderResponse.setTitle(accountEntryDisplay.getName());
 				<liferay-ui:search-container-column-text
 					cssClass="table-cell-expand-small table-cell-minw-150"
 					name="name"
-					property="name"
+					value="<%= HtmlUtil.escape(accountOrganization.getName()) %>"
 				/>
 
 				<liferay-ui:search-container-column-text
 					cssClass="table-cell-expand-small table-cell-minw-150"
 					name="parent-organization"
-					property="parentOrganizationName"
+					value="<%= HtmlUtil.escape(accountOrganization.getParentOrganizationName()) %>"
 				/>
 
 				<c:if test="<%= AccountEntryPermission.contains(permissionChecker, accountEntryDisplay.getAccountEntryId(), AccountActionKeys.MANAGE_ORGANIZATIONS) %>">

@@ -62,14 +62,14 @@ renderResponse.setTitle(accountEntryDisplay.getName());
 					cssClass="table-cell-expand-small table-cell-minw-150"
 					href="<%= rowURL %>"
 					name="name"
-					value="<%= accountRoleDisplay.getName(locale) %>"
+					value="<%= HtmlUtil.escape(accountRoleDisplay.getName(locale)) %>"
 				/>
 
 				<liferay-ui:search-container-column-text
 					cssClass="table-cell-expand-small table-cell-minw-150"
 					href="<%= rowURL %>"
 					name="description"
-					value="<%= accountRoleDisplay.getDescription(locale) %>"
+					value="<%= HtmlUtil.escape(accountRoleDisplay.getDescription(locale)) %>"
 				/>
 
 				<liferay-ui:search-container-column-text

@@ -29,13 +29,13 @@ SearchContainer<Organization> organizationSearchContainer = AssignableAccountOrg
 			<liferay-ui:search-container-column-text
 				cssClass="table-cell-expand-small table-cell-minw-150"
 				name="name"
-				property="name"
+				value="<%= HtmlUtil.escape(organization.getName()) %>"
 			/>
 
 			<liferay-ui:search-container-column-text
 				cssClass="table-cell-expand-small table-cell-minw-150"
 				name="parent-organization"
-				property="parentOrganizationName"
+				value="<%= HtmlUtil.escape(organization.getParentOrganizationName()) %>"
 			/>
 		</liferay-ui:search-container-row>
 

@@ -30,13 +30,13 @@ accountRoleDisplaySearchContainer.setRowChecker(new SelectAccountUserAccountRole
 			<liferay-ui:search-container-column-text
 				cssClass="table-cell-expand-small table-cell-minw-150"
 				name="name"
-				value="<%= accountRole.getName(locale) %>"
+				value="<%= HtmlUtil.escape(accountRole.getName(locale)) %>"
 			/>
 
 			<liferay-ui:search-container-column-text
 				cssClass="table-cell-expand-small table-cell-minw-150"
 				name="description"
-				value="<%= accountRole.getDescription(locale) %>"
+				value="<%= HtmlUtil.escape(accountRole.getDescription(locale)) %>"
 			/>
 		</liferay-ui:search-container-row>
 

@@ -68,7 +68,7 @@ ViewAccountEntriesManagementToolbarDisplayContext viewAccountEntriesManagementTo
 					cssClass="table-cell-expand"
 					href="<%= rowURL %>"
 					name="organizations"
-					property="organizationNames"
+					value="<%= HtmlUtil.escape(accountEntryDisplay.getOrganizationNames()) %>"
 				/>
 
 				<liferay-ui:search-container-column-text