Skip to content
Permalink
Browse files Browse the repository at this point in the history
fix: [security] XSS in cerebrate view
- low probability XSS in the cerebrate view's URL field
- a malicious administrator could set a javascript: url
- another administrator would have to click the suspicious looking URL to be affected

- As reported by Dawid Czarnecki of Zigrin Security on behalf of the Luxembourg Army
  • Loading branch information
iglocska committed Apr 17, 2022
1 parent bb3b7a7 commit 60c85b8
Showing 1 changed file with 5 additions and 0 deletions.
Expand Up @@ -12,6 +12,11 @@ if (!empty($field['url'])) {
}
foreach ($field['url_vars'] as $k => $path) {
$field['url'] = str_replace('{{' . $k . '}}', Hash::extract($data, $path)[0], $field['url']);
$temp = explode(':', $field['url']);
if (!in_array(strtolower($temp[0]), ['http', 'https'])) {
$field['url'] = '#';
$string = 'Malformed URL - invalid protocol (' . h($temp[0]) . ':)';
}
}
}
$string = sprintf(
Expand Down

0 comments on commit 60c85b8

Please sign in to comment.