Fix xss though the description in the info.xml file of a theme or module #3499
Conversation
carakas
added
Extensions
security
Codecov Report
@@ Coverage Diff @@
## master #3499 +/- ##
=========================================
Coverage 27.88% 27.88%
Complexity 8145 8145
=========================================
Files 575 575
Lines 30691 30691
=========================================
Hits 8557 8557
Misses 22134 22134
Flags with carried forward coverage won't be shown. Click here to find out more.
Continue to review full report at Codecov.
|
| @@ -839,7 +839,7 @@ public static function processModuleXml(\SimpleXMLElement $xml): array | |||
| $information['name'] = (string) $module->name; | |||
| $information['version'] = (string) $module->version; | |||
| $information['requirements'] = (array) $module->requirements; | |||
| $information['description'] = (string) $module->description; | |||
| $information['description'] = strip_tags((string) $module->description, '<h1><h2><h3><h4><h5><h6><p><li><a>'); | |||
There was a problem hiding this comment.
Fine by me, but shouldn't this be some generic function where we can centralise the safe tags?
There was a problem hiding this comment.
symfony is busy making a package (no 1.0.0 release yet) that will be included in version 6.1 that I'm already using in fork 6 so didn't think of making something custom for this.
Fixed this because of a security issue that was reported to me
Type
Resolves the following issues
Pull request description
Sanitise the HTML that is allowed in the description of a module or theme to prevent XSS