Problem/Motivation

The readmoreLink setting is vulnerable to a XSS vulnerability.

Steps to reproduce

Use this config:

moreInfoLink: true
readmoreLink: '"><img src="x" onerror="alert(''foo'')">'

tarteaucitron.js does not sanitize the value before using it in the href attribute.

Proposed resolution

Html::escape() could be used to sanitize the string.

Issue fork tarte_au_citron-3372664

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

prudloff created an issue. See original summary.

prudloff’s picture

prudloff commented

Html::escape() might not be enough, UrlHelper::filterBadProtocol() is probably the correct solution here.

klelostec made their first commit to this issue’s fork.

klelostec opened merge request !8

klelostec’s picture

klelostec commented
Status: Active » Fixed
Issue tags: -Security
klelostec’s picture

klelostec commented
Issue tags: +Security
klelostec’s picture

klelostec commented

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.