Problem/Motivation

NameFormatParserService.php
Lines 119-121

      // Unescaped text.
      case 'raw':
        return $name_string;

It requires a trusted admin to deliberately enable a clearly-labeled "Raw (not recommended)" option, which is why it's Medium rather than Critical, but it's a live foot-gun.

Steps to reproduce

Proposed resolution

case 'raw':
  return Markup::create(Xss::filterAdmin($name_string));

Also add a regression test that pushes <script>alert(1)</script> through NameFormatter::viewElements() and asserts it's sanitized.

Remaining tasks

User interface changes

API changes

Data model changes

Issue fork name-3586350

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

bluegeek9 created an issue. See original summary.

bluegeek9’s picture

bluegeek9 commented
Issue summary: View changes
bluegeek9’s picture

bluegeek9 commented
Assigned: Unassigned » bluegeek9

bluegeek9 opened merge request !82

  • bluegeek9 committed 52bf94e4 on 8.x-1.x 
    feat: #3586350 Opt-in raw markup mode permits stored XSS of name...
bluegeek9’s picture

bluegeek9 commented
Assigned: bluegeek9 » Unassigned
//www.flaticon.com/free-icons/thank-you Thank you for your contribution! Your continued support makes this project sustainable.
There are multiple ways to show appreciation for the work contributed to this project including:
bluegeek9’s picture

bluegeek9 commented
Status: Active » Fixed

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.