Problem/Motivation

Line 35 in js/webform.form.tabs.js uses an unescaped parameter from URL which could potentially lead to XSS issues.

tabIndex = $('a[href="' + location.hash + '"]').data('tab-index');

Proposed resolution

Filter parameters retrieved from URL using Drupal.checkPlain() https://www.drupal.org/docs/security-in-drupal/writing-secure-code-for-d...

Issue fork webform-3219589

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

piggito created an issue. See original summary.

piggito opened merge request !40

piggito’s picture

piggito commented
Assigned: piggito » Unassigned
Status: Active » Needs review
jrockowitz’s picture

jrockowitz commented
jrockowitz’s picture

jrockowitz commented
Status: Needs review » Fixed

  • jrockowitz committed 1a4acf6 on 6.x authored by piggito 
    Issue #3219589 by piggito: XSS prevention on webform.form.tabs.js

  • piggito authored d2249be on 8.x-5.x 
    Issue #3219589 by piggito: XSS prevention on webform.form.tabs.js

  • piggito authored d2249be on 6.x 
    Issue #3219589 by piggito: XSS prevention on webform.form.tabs.js

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.