Conversation
There was a problem hiding this comment.
Pull request overview
This PR addresses an XSS vector in weForms entry handling by sanitizing stored entry values (notably for hidden fields submitted via the REST API) and by removing unsafe HTML rendering in the admin SPA entry list/detail UI.
Changes:
- Sanitize scalar entry values in the default
prepare_entry()flow to prevent unsanitized hidden-field payloads submitted via REST. - Replace
v-htmlrendering with Vue’s escaped interpolation for entry list/table cells. - Restrict
v-htmlusage in the entry single/detail view to textarea fields (and keep existing special cases like address).
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
| includes/fields/class-abstract-fields.php | Sanitizes default scalar entry values during entry preparation (impacts hidden field REST submissions). |
| assets/spa/components/form-entry-single/template.php | Adjusts entry-detail rendering to avoid v-html for most field types, limiting raw HTML rendering to textarea. |
| assets/js-templates/spa-components.php | Updates generated SPA templates to escape entry field values in list/detail views instead of rendering raw HTML. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 7 out of 7 changed files in this pull request and generated 3 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Remove dead $org_field assignment in get_changed_fields() that triggered "Undefined array key 'original_name'" before the existing empty() guard - Add empty() check on wpuf_cond before dereferencing condition_status to fix "Trying to access array offset on null" when a field has no cond logic Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 12 out of 12 changed files in this pull request and generated 3 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 12 out of 12 changed files in this pull request and generated 4 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
You can also share your feedback on Copilot code review. Take the survey.
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 12 out of 12 changed files in this pull request and generated 3 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
You can also share your feedback on Copilot code review. Take the survey.
https://imh-internal.atlassian.net/browse/ENG7-1407
Manual Testing Guide
Prerequisites
key name)
Password (WP Admin → Users → Edit User → Application
Passwords)
Step 1 — Get a WPUF nonce
Copy the nonce value from the output.
Step 2 — Submit an XSS payload via REST API
Expected response (patched): the hidden_test value in the![]()
tag stripped.
response data should be ">" — the
Expected response (unpatched): the full payload ">
appears unsanitized.
Step 3 — Verify no XSS in the entries list
Log in as admin and navigate to weForms → (your form) →
Entries.
as plain text
Step 4 — Verify no XSS in the entry detail view
Click Details on the entry submitted in Step 2.
dialog
Step 5 — Verify textarea display is unaffected
Submit a normal entry through the front-end form (or via
the same curl command with a clean message value). Open the
entry detail view.
(paragraph-wrapped text displays as formatted text, not as
escaped <p> tags)
Step 6 — Verify normal hidden field values are unaffected
Submit with a clean hidden field value:
Expected: hidden_test stored and displayed as
my-tracking-value with no truncation or mangling.