Task Descriptions Were Not Cleaned

Security: task descriptions were shown without being cleaned

Fixed in 3.12.0 · Found while building the Work view for #190 · Present in every release from 1.0.0 to 3.11.0 · Module: Tasks

---

The short version

A task's description is formatted text (HTML). The task window and the Calendar and Timeline quick panels put it into the page without cleaning it. A description crafted to contain a script - for example a picture whose error handler runs code - ran in the browser of whoever opened the task, with that person's access.

Who could write one: anybody who can edit tasks, or a REST API key that can. And, if a workflow copies ticket text into a task, whoever raised the ticket: the Create a task workflow action fills its description from merge codes such as {{ticket.subject}} without escaping them, so a requester's email or portal ticket could supply the markup.

The Work view, added in the same release, already cleaned the description, which is how the gap was noticed.

What was wrong

Email bodies are cleaned before display by one shared cleaner, safeHtmlFragment() in assets/js/safe-html.js: it removes scripts, every on… attribute and javascript: links, and keeps formatting and images. Task descriptions never went through it:

• assets/js/tasks.js built the editor with <div id="descriptionEditor">${task.description}</div>. The rich-text editor that takes over the element afterwards is no protection; the handler has already run by the time the markup is inserted.
• assets/js/tasks-quick-panel.js showed the description preview the same way, and the Calendar and Timeline pages did not load the cleaner at all.

The fix

Both now go through the shared cleaner - taskDescriptionHtml() in tasks.js - and fall back to plain text if the cleaner is ever missing. The Calendar and Timeline pages load safe-html.js. Formatting and pasted screenshots are kept, so nothing changes for anybody using descriptions normally. There is a TRAP: comment at both places.

Descriptions are cleaned when shown rather than when saved, as email bodies are: the server-side cleaner removes images, and analysts paste screenshots into tasks.

📁 Files changed

	File	Change
🟦	assets/js/tasks.js	taskDescriptionHtml(); the editor uses it
🟦	assets/js/tasks-quick-panel.js	The preview is cleaned
🟦	tasks/index.php, tasks/calendar/index.php, tasks/timeline/index.php	Load safe-html.js before the task scripts; cache-busters
🟩	tests/task-description-render.php	New guard

Tested

In headless Chrome, a description carrying an <img onerror>, an <svg onload> and a javascript: link: inserted the old way, both handlers fired; through the fix, none did, bold text and an embedded image survived, and with the cleaner removed the description showed as plain text. tests/task-description-render.php fails four of its seven checks on the old code and passes on the new.

Do I need to do anything?

No - upgrading is the fix. If you have a workflow whose Create a task action puts ticket text into the description, and you want to be sure nothing was planted, look over the tasks it created for descriptions you did not expect.

---

Related: Tasks · Workflow · Bugs resolved