strip script tags from XSLT block stylesheets

zikula-modules · Sep 20, 2021 · 3e1b581 · 3e1b581
1 parent 05bcec7
commit 3e1b581
Showing 1 changed file with 7 additions and 0 deletions.
diff --git a/Block/XsltBlock.php b/Block/XsltBlock.php
@@ -38,6 +38,13 @@ public function display(array $properties): string
         } else {
             $doc->loadXML($properties['stylecontents']);
         }
+
+        // remove scripts
+        $scriptTags = $doc->getElementsByTagName('script');
+        foreach ($scriptTags as $scriptTag) {
+            $scriptTag->parentNode->removeChild($scriptTag);
+        }
+
         $xsl->importStyleSheet($doc);
 
         // load xml source