[#44424] - Update admin-update-default.es6.js SanitizHTML DOM Text Interpretd as HTML
- Pending
- Medium
- Build: 5.2-dev
- # 44424
- Diff
- Shivam7-1:patch-5
User tests: Successful: Unsuccessful:
Summary of Changes
In This PR Joomla.sanitizeHtml to sanitize all HTML content rendered within the application. This change improves security by preventing XSS (Cross-Site Scripting) vulnerabilities and ensures that user-generated or external HTML is safe. All relevant components have been updated for consistent sanitization, enhancing overall application integrity.
Link to documentations
Please select:
-
Documentation link for docs.joomla.org:
-
No documentation changes for docs.joomla.org needed
-
Pull Request link for manual.joomla.org:
-
No documentation changes for manual.joomla.org needed
| Status | New | ⇒ | Pending |
joomla-cms-bot
- | Category | ⇒ | JavaScript Repository NPM Change |
| Labels |
Added:
Test instructions missing
Updates Requested
NPM Resource Changed
PR-5.2-dev
|
||
Thank you for creating this PR, however I'm not considering this a bugfix and at this point in time I will only accept bugfixes for 5.2. Please change the PR to be against 5.3-dev. Thank you.
Hii @Hackwar @dgrammatiko Thanks for Reviewing PR I had Done Changes According to Suggestions Could Team Review This PR again
Thanks
Hii @Hackwar @dgrammatiko Thanks for Reviewing PR I had Done Changes According to Suggestions Could Team Review This PR again
Thanks
Ping @dgrammatiko
| Labels |
Added:
Feature
PR-5.3-dev
Removed: PR-5.2-dev |
||
Hii Reviewers @dgrammatiko
Thank You so Much For Reviewing 😃
I understand the concern about using Joomla.sanitizeHtml() without proper configuration. The intent was to sanitize potentially unsafe HTML, but I agree that it could break things when not properly configured for specific elements and their attributes. As a result, I will update the code to use
textContent, which will ensure that any HTML is rendered as plain text, avoiding the potential for broken content or issues with element attributes.I don’t have a specific test case to demonstrate an exploit, but I can explain how the issue could be tested. The potential vulnerability lies in cases where user-provided content—such as input from forms or comments—could be injected into the page and rendered without proper sanitization.
I will proceed with the change to
textContentto eliminate this risk