CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). On the url: [http://localhost:8080/ui/?primaryEnvironmentName=ditto_sandbox](http://localhost:8080/ui/?primaryEnvironmentName=ditto_sandbox) javascript code can be executed. Steps to reproduce: * Visit the following URL: http://localhost:8080/ui/?primaryEnvironmentName=ditto_sandbox * Select Policies Imports with the following payload: `<img src=x onerror=prompt(876)></img>` (See screenshot) * Press "Create", then it triggers the execution of Javascript *  <!-- Please, do not remove the line below. It will create a confidential issue that will be visible only to you and the members of this project. Confidential issues are used to keep security vulnerabilities private until they are sorted out. Eclipse Projects follow Responsible Disclosure best practices: the initial report is made privately, but with the full details being published once a patch has been made available (sometimes with a delay to allow more time for the patches to be installed). -->