Feeling Lucky
NPM Resource Changed
?
?
?
[#34481] - [4.0] Sanitization for code using insertAdjacentHTML
- Fixed in Code Base
- 12 Jun 2021
- Medium
- Build: 4.0-dev
- # 34481
- Diff
- dgrammatiko:—more-sanitization—4.0-dev
User tests: Successful: Unsuccessful:
Pull Request for Issue # .
this is also a RELEASE BLOCKER
Summary of Changes
- Code that injects HTML using
insertAdjacentHTMLshould first sanitize the string
Testing Instructions
Apply the PR or download the installable package from the Github PR
- Check that the Stats plugin works correctly (eg the first notification when you log in for the first time in the admin)
- Check that you can select an image in the intro/fulltext position and also inside an editor
Actual result BEFORE applying this Pull Request
Code vulnerable to XSS
Expected result AFTER applying this Pull Request
Vulnerabilities mitigated
Documentation Changes Required
| Status | New | ⇒ | Pending |
joomla-cms-bot
- | Category | ⇒ | JavaScript Repository NPM Change |
| Labels |
Added:
NPM Resource Changed
?
?
|
||
| Labels |
Added:
?
Removed: ? |
||
| Labels |
Added:
?
Removed: ? |
||
dgrammatiko
- comment
- 10 Jun 2021
(I assume the image select was removed intentionally)
Indeed it was
sandramay0905
- comment
- 11 Jun 2021
I have tested this item
- Statistics-Plugin is showing on pages until user select one button like
Always - Images are loaded saved and shown in frontend in intro-, fulltext and editor.
- Smartsearch-index clear and reindex of all available languages using multilangual- and blog-sample data.
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/34481.
| Status | Pending | ⇒ | Ready to Commit |
alikon
- comment
- 11 Jun 2021
RTC
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/34481.
| Status | Ready to Commit | ⇒ | Fixed in Code Base |
| Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2021-06-12 12:43:04 |
| Closed_By | ⇒ | richard67 | |
| Labels |
Added:
?
?
Removed: ? |
||
richard67
- comment
- 12 Jun 2021
Thanks!
I have tested this item✅ successfully on 9d53166
tested smart search index
tested stats plugin
(I assume the image select was removed intentionally)
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/34481.