Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fixed: Sanitize text format names in hint below editor. #6065

Closed
jenlampton opened this issue Apr 17, 2023 · 3 comments · Fixed by backdrop/backdrop#4406
Closed

Fixed: Sanitize text format names in hint below editor. #6065

jenlampton opened this issue Apr 17, 2023 · 3 comments · Fixed by backdrop/backdrop#4406

Comments

@jenlampton
Copy link
Member

jenlampton commented Apr 17, 2023

Description of the bug

The text format label is correctly sanitized on the text formats page, and in the select list on the node/add page, but in the hint below the text editor, it is not properly sanitized when the current text format changes. (In this scenario, the text is replaced by JavaScript).

Steps To Reproduce

To reproduce the behavior:

  1. create a new text format named test<script>alert('XSS');</script>
  2. Go to the node/add/page page
  3. Change the text format to your new one
  • Notice that in the select list the text is properly sanitized 👍🏼
  • Notice that in the text filter wrapper summary, it is not 👎🏼
@jenlampton
Copy link
Member Author

I pushed a PR for this that is ready for testing.

@bugfolder
Copy link

Tested. Verified the lack of sanitization before; verified that the code change fixes the problem. Code looks good. WFM, RTBC.

@quicksketch
Copy link
Member

I merged in backdrop/backdrop#4406 into 1.x and 1.24.x. Thanks!

Note that this issue is public and does not receive a CVE because any administrator that can configure a text format could easily allow Full HTML anywhere.

@quicksketch quicksketch modified the milestones: 1.24.3, 1.24.2 Apr 19, 2023
@jenlampton jenlampton changed the title Sanitize text format names in hint below editor Fixed: Sanitize text format names in hint below editor. Apr 19, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants