XSS bugs in apex 4.1.1.00.23?

Question

Hi,
During XSS testing of new application by loading every char database column with html markup I came across 2 area's where HTML is executed by Apex where I didn't expect it to be.
I'm wondering if these are bug or that they are intentional and I should program around them?
Interactive report column dropdown
HTML tags in a table column on which an IRR is created
By default every column is "display as text (escape special characters)".
The column value in the report itself are displayed correctly with the HTML escaped.
However when I click on the column header and the dropdown menu appears the column value isn't escaped in the search list . It is actually rendered with HTML
item substitution variables in region header
Create a form on a table (EMP) with automatic row fetch
Create a record with (P1_)EMP_NAME containing HTML markup
Reference the page item in the region title &P1_EMP_NAME.
If you then load the page/record you'll see the value of EMP_NAME properly escaped in both your page item as in the region title
Now edit the page and set P1_EMP_NAME to display only
If you then load the page/record again you'll see the value of EMP_NAME properly is still escaped in your page item, however the HTML is rendered in the region title
Can anyone confirm this as bugs or intentional?
Apodictus

Answer 1

This is a known bug. Refer to the following thread for more details:
Re: HTTP Header Variable
This is fixed in 4.1.1 or you may apply the patchset:
12955671 - HTTP HEADER VARIABLE AUTH: ENDLESS REDIRECT IF USERNAME IS CASE SENSITIVE