Problem/Motivation

In issues #3554029 and #3533416 we discussed the possibility of creating a role with HTML in its label. HTML was properly escaped at the time and we made shure JS does not reintroduce unescaped HTML in the tab summary.

In issue #3374118 HTML escaping was unnecessarily removed by commit d3db174f. Now it is possible to inject HTML in MatomoAdminSettingsForm by a user with permission 'administer permissions'.

Steps to reproduce

  1. Enable the module
  2. As a user with "administer permissions" permission, create or edit an existing role with HTML in name. For example <img src="csrf">.
  3. As a user with "administer matomo" permission access /admin/config/system/matomo, open tab "Roles".
  4. HTML is inserted unescaped into the role list.
  5. Check the role with label containing HTML.
  6. HTML is inserted unescaped into the vertical tab summary.

"Roles" tab with a broken image

Proposed resolution

Reintroduce HTML escaping for labels created from user input.

CommentFileSizeAuthor
Screenshot 2026-01-22 120425.png69.67 KBhosterholz

Issue fork matomo-3568964

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

hosterholz created an issue. See original summary.

hosterholz opened merge request !95

hosterholz’s picture

hosterholz
he/him
Primary language German
commented
Status: Active » Needs review

hosterholz opened merge request !96

hosterholz’s picture

hosterholz
he/him
Primary language German
commented
Status: Needs review » Active

Also present in 1.26 / 1.x-dev. I cherry-picked the fix from 2.0.x to 8.x-1.x and created another merge request.

hosterholz’s picture

hosterholz
he/him
Primary language German
commented
Status: Active » Needs review
grimreaper’s picture

grimreaper
Primary language French
Location France 🇫🇷
commented
Assigned: Unassigned » grimreaper

grimreaper’s picture

grimreaper
Primary language French
Location France 🇫🇷
commented
Version: 2.0.0-alpha4 » 2.0.x-dev
Assigned: grimreaper » Unassigned
Status: Needs review » Fixed

Thanks!

Merged.

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.