This was originally reported as a private security issue, but has been approved for handling the public queue by the Drupal Security Team.

Problem/Motivation

The webform_submission_log submodule has a potential XSS vulnerability because it does not sanitize log messages before displaying them.

This could be a problem if some custom code logs a message containing unescaped user input.

Steps to reproduce

1. Enabling the webform_submission_log module
2. Call something like this:

\Drupal::logger('webform_submission')->error('<img src=x onerror=alert()>', $context);

3. Browse to /admin/structure/webform/submissions/log: the JS is executed.

(dblog does not have this problem, it always filters log messages against XSS.)

Proposed resolution

We could filter log messages with Xss::filterAdmin() before displaying them (dblog does this).

Remaining tasks

User interface changes

API changes

Data model changes

Issue fork webform-3547533

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

prudloff created an issue. See original summary.

jrockowitz made their first commit to this issue’s fork.

jrockowitz’s picture

jrockowitz commented
Status: Active » Needs review

jrockowitz opened merge request !745

jrockowitz’s picture

jrockowitz commented
Status: Needs review » Reviewed & tested by the community

RTBC if tests pass

liam morland made their first commit to this issue’s fork.

liam morland’s picture

liam morland
Primary language English
Location Ontario, CA 🇨🇦
commented

This change cherry-picks cleanly onto 6.2.x.

jrockowitz’s picture

jrockowitz commented
Status: Reviewed & tested by the community » Needs work

benstallings made their first commit to this issue’s fork.

benstallings’s picture

benstallings commented
Status: Needs work » Needs review

I just rebased, and this branch is looking good!

liam morland’s picture

liam morland
Primary language English
Location Ontario, CA 🇨🇦
commented
Status: Needs review » Fixed

Thanks!

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.