While working on #2567257: hook_tokens() $sanitize option incompatible with Html sanitisation requirements, we discovered that some comment tokens (title, parent, author, and entity) are being XSS::filter()'d instead of Html::escape()'d. This is wrong, because < and > within these fields should be interpreted literally, not as markup. See #2567257-43: hook_tokens() $sanitize option incompatible with Html sanitisation requirements and #2567257-46: hook_tokens() $sanitize option incompatible with Html sanitisation requirements for more detailed discussion about that.
Fix these lines of code from XSS::filter() to Html::escape().
Child issue of #2567257: hook_tokens() $sanitize option incompatible with Html sanitisation requirements and necessary for that issue to finish, so Critical.
| Comment | File | Size | Author |
|---|---|---|---|
| #2 | comment-tokens.patch | 3.97 KB | effulgentsia |
Comments
Comment #2
effulgentsia commentedComment #3
dawehnerSo do we really want to split out everything again in their own individual subissues?
Comment #4
effulgentsia commentedNo, just the ones that change the output. There's not many that do, and the others shouldn't: I'll comment on those in the parent issue.
Comment #6
effulgentsia commentedIn order to unblock the parent issue, I committed and pushed this to 8.0.x.
I assigned commit credit in the commit message to @catch who first discovered this when initially opening the parent issue, and to @Xano and @stefan.r who worked on the #14 and #18 patches in that issue that dealt with this.
@catch, @Xano, @stefan.r: if you want to add comments here, then I'll be able to check those credit boxes so that you have credit on d.o. for this as well.
Comment #7
heddnIn D7, there's also #1994694: Comment token subject and body tokens are incorrectly escaped. Does anything here need to be backported into it?