Background information

This was originally reported as a private security issue, but has been approved for handling in the public queue by the Drupal Security Team.

Problem/Motivation

recaptcha has a known XSS sink in the data-error-callback attribute : https://gmsgadget.com/gadgets/recaptcha/#Latest%20(1)

If an attacker can write markup with this attribute, it can trigger a call to a JS function.
Xss::filter() does not remove data attributes so there are various ways to insert the payload (although the fact that the HTML payload needs to be on a page that has a captcha could make it harder to exploit).
It is also mitigated by the fact CKE does not allow data attributes by default.

Steps to reproduce

1. Enable the recaptcha, webform and html_title modules
2. Create a webform with a recaptcha.
3. Create a bundle with a webform field.
4. As an attacker that can create nodes in this bundle, create a node with this title: <sub class="g-recaptcha" data-sitekey="1337" data-error-callback="alert">XSS</sub>
Select the webform in the webform field.
5. When the node is displayed, the JS is executed.

Proposed resolution

I'm not sure about the correct way to fix this. The attribute should probably be stripped but we don't really have a mechanism for modules to extend Xss::filter().
Maybe a JS that runs as soon as the DOM is ready and removes the attribute?
But it would have to be sure to run before the recaptcha JS.

Remaining tasks

User interface changes

API changes

Data model changes

Comments

prudloff created an issue.