Hey guys, I am reading about XSS Vulnerability Patch 2 | https://netsuite.custhelp.com/app/answers/detail/a_id/95744 However, I am kind of confused about the part where it mentions the response text

Every View with a form should have this function implemented to apply this patch. An alternative would be to declare

transformResponseText: function(response) {
    response.responseText = _.unescape(response.responseText);
},

in Backbone.FormView.js as the default implementation so that you don’t have to redeclare it in every view. But if you do ever override that method, it will need to include that default implementation.

Thanks for your reply @Mark!

Thats not great documentation…..this really should be specific so nothing is missed.

Yeah, I agree. @Steve Goldberg sorry for bothering you on Friday but could we get better instructions on this patch? It is not really clear the last step.

I have passed on your comments.

Thank you!

Tech writers say that they have updated on the doc already, can you check and see if it's what you were expecting

Wow, so there was only one file necessary to be updated on the last step, this is more clear now, however it's kind of completely different of what the previous instruction was stating. Thanks for the help! @Steve Goldberg at least now I am sure what file need to be updated. @Mark does it make sense to you? It seems you had applied the patch following the previous instructions.

The updated docs makes sense since the login form is probably the only form in SCA with sensitive information (e.g. password), making it the main target for XSS attacks. I’m assuming other forms are vulnerable, but just not as important.

Thanks for your input!