Cookies problem

Hello cl4r7t4,

Could i please ask you to translate this to English, i am a non-italian speaker.

Thanks.

I can confirm this problem still exists in 8.x-1.29 even though the issue "#3527482 by codebymikey: Ensure category scripts are properly loaded" should have been fixed.

https://www.drupal.org/project/eu_cookie_compliance/releases/8.x-1.29

Hi all, does the issue still occur in the new 1.30-rc branch?

Yes, problem still occurs in 8.x-1.30-rc2.

Downgrading to eu_cookie_compliance 8.x-1.26 fixed the problem for us. In version 8.x-1.26 security issue "EU Cookie Compliance (GDPR Compliance) - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-072" is already fixed, so for the time being this is a practicable workaround for us.

Hi,
I've created an issue fork, this should fix, for now, at least the translation issue.

I do need a better reproduction in order to assess the first issue with scripts not running. If someone is able to prepare some steps that would be fantastic.

If however, by downgrading to 1.26, then that means we have a regression between 1.29 and 1.26.

Thanks!

Reproducing the bug:

• Create a custom Javascript and place it in themes or modules dir, eg /modules/custom/testscript/js/script.js . Do not use hook_page_attachments or similar to load it.
• Add a categorie, eg. 'tracking' via /admin/config/system/eu-cookie-compliance/categories.
• In the module's settings /admin/config/system/eu-cookie-compliance/settings add the script in the section 'Disable the following JavaScripts when consent isn't given' like this 'tracking:/modules/custom/testscript/js/script.js'

Expected behavior:

When user allows the category 'tracking' via the Cookie Banner, the script at /modules/custom/testscript/js/script.js is loaded.

This works in versions <= 8.x-1.26 and is broken in later versions.

@atowl Should priority maybe raised to critical when main functionality with categories is complete broken?

This poses a significant problem given that security updates exist for older versions not affected by this issue.

Hi guys,
Sorry I've been a bit absent from this issue, it's been a bit busy.

Thanks for the reproduction @electric.larry, this is helpful.
Versions of the EUCC <= 1.26 did not take into account the implications of loading scripts indiscriminately, i.e., they would load scripts even if they weren't already attached to the page. The security implications were that the EUCC module could be used to load arbitrary scripts that weren't necessarily part of the page's normal render process.

The way you're loading the script isn't quite the Drupal way—Drupal's asset management system isn't aware of scripts that aren't attached via libraries, hook_page_attachments(), or render arrays. The module now only manages scripts that are properly attached to the page through Drupal's standard methods.

I think to work around this, you should try:
* Define your script in a *.libraries.yml file
* Attach it to pages using hook_page_attachments() or #attached in render arrays
Then EUCC can properly manage it based on consent categories

Would you be able to test if this approach works for your use case?

Sorry for the delay @atowl, I missed your response.

I followed the steps you described in #13 and it's working on v1.29.0