[SECURITY] Prevent XSS in SelectMultipleSideBySideElement 09/47609/2
authorNicole Cordes <typo3@cordes.co>
Tue, 12 Apr 2016 09:11:15 +0000 (11:11 +0200)
committerOliver Hader <oliver.hader@typo3.org>
Tue, 12 Apr 2016 09:11:18 +0000 (11:11 +0200)
commitc5df0d116847646abfa824b18ac35c26d4a94c64
treeebf86c71ec925696179bd489932b8b8fd023fda2
parentedad889931feab888884cd070e819ebecd243a86
[SECURITY] Prevent XSS in SelectMultipleSideBySideElement

In Javascript context the title attribute of a selected option is passed
as unescapd HTML argument to the function. Creating a new option tag
without title validation results in a XSS possibility. This patch removes
hardcoded attribute setting and uses jQuery function which take care
of proper escaping.

Resolves: #75164
Releases: master, 7.6, 6.2
Security-Commit: c6ec139a9ad69db67c17b1f3688b07e65f8898cc
Security-Bulletins: TYPO3-CORE-SA-2016-009, 010, 011, 012
Change-Id: Ie664fdaf71f4f28f66b0e7cde42da1d6284b1f02
Reviewed-on: https://review.typo3.org/47609
Reviewed-by: Oliver Hader <oliver.hader@typo3.org>
Tested-by: Oliver Hader <oliver.hader@typo3.org>
typo3/sysext/backend/Resources/Public/JavaScript/FormEngine.js