Problem/Motivation

The notification message displayed when autosaving is output verbatim, leading to an XSS vulnerability. Since configuration for Autosave Form requires the "administer site configuration"-permission, this can be fixed publicly as per Security advisory process and permissions policy

Steps to reproduce

Visit the configuration page for Autosave Form, and set "<script>alert('xss');</script>" as notification message. Edit content for which autosaving is enabled, the script will be executed immediately upon page load.

Proposed resolution

Run the message through Xss::filter() or Xss::filterAdmin().

Issue fork autosave_form-3512987

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

mr.baileys created an issue. See original summary.

mr.baileys opened merge request !28

mr.baileys’s picture

mr.baileys
Primary language Dutch
Location 🇧🇪 (Ghent)
commented
Status: Active » Needs review
sdhruvi5142’s picture

sdhruvi5142 commented
Status: Needs review » Reviewed & tested by the community

The proposed solution correctly addresses the XSS vulnerability by sanitizing the notification message with Xss::filterAdmin(). Since this configuration requires admin privileges, using filterAdmin() is appropriate as it maintains necessary HTML formatting while stripping dangerous scripts. I've verified the fix by testing with various payloads (including <script> tags and HTML attributes) and confirmed it prevents execution while preserving legitimate markup. The implementation follows Drupal's security best practices by sanitizing at output time without breaking existing functionality.

Moving this to RTBC but creating a new issues for fixing the phpcs issues and wraning showing up in the pipeline.

#3515975

steinmb’s picture

steinmb commented

Is there anything holding this back from getting merged? Looks RTBC to me.