Commit 1d0abfa0 authored by Oliver Bartsch's avatar Oliver Bartsch Committed by Oliver Hader
Browse files

[SECURITY] Mitigate XSS in PreviewRenderer for menus

The content element preview for menus displays the
menu type label along with the record title of the
defined pages and categories. Since the output was
not properly encoded, this led to a XSS vulnerability
in the page module.

The issue is addressed by properly encoding user input.

Note: Because of a bug in `PreviewRenderer`, the
vulnerable code was most likely not executed in any
TYPO3 installation after v8.6.0.

Resolves: #93664
Releases: master, 11.1, 10.4, 9.5
Change-Id: I56ec17f5f07ff4d7c28f2241e0c9eeee9affd71f
Security-Bulletin: TYPO3-CORE-SA-2021-008
Security-References: CVE-2021-21370
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/68417

Tested-by: Oliver Hader's avatarOliver Hader <oliver.hader@typo3.org>
Reviewed-by: Oliver Hader's avatarOliver Hader <oliver.hader@typo3.org>
parent 62b218c0
......@@ -2240,7 +2240,7 @@ class PageLayoutView implements LoggerAwareInterface
BackendUtility::getLabelFromItemListMerged($row['pid'], 'tt_content', 'menu_type', $row['menu_type'])
);
$menuTypeLabel = $menuTypeLabel ?: 'invalid menu type';
$out .= $this->linkEditContent($menuTypeLabel, $row);
$out .= $this->linkEditContent(htmlspecialchars($menuTypeLabel), $row);
if ($row['menu_type'] !== '2' && ($row['pages'] || $row['selected_categories'])) {
// Show pages if menu type is not "Sitemap"
$out .= ':' . $this->linkEditContent($this->generateListForCTypeMenu($row), $row) . '<br />';
......@@ -2353,7 +2353,7 @@ class PageLayoutView implements LoggerAwareInterface
foreach ($uidList as $uid) {
$uid = (int)$uid;
$record = BackendUtility::getRecord($table, $uid, 'title');
$content .= '<br>' . $record['title'] . ' (' . $uid . ')';
$content .= '<br>' . htmlspecialchars($record['title']) . ' (' . $uid . ')';
}
return $content;
}
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment