Bug #22886

Make menu titles in the FE htmlspecialchared by default

Added by Oliver Klee almost 9 years ago. Updated 23 days ago.

Status:
Accepted
Priority:
Should have
Assignee:
Category:
Frontend
Start date:
2010-06-15
Due date:
% Done:

0%

TYPO3 Version:
6.0
PHP Version:
5.3
Tags:
Complexity:
Is Regression:
No
Sprint Focus:

Description

1. to prevent XSS (by editors who can create pages)
2. to make the FE valid

(issue imported from #M14732)

History

#1 Updated by Helmut Hummel about 8 years ago

Do you mean TypoScript like foo = TMENU ... or something in css_styled_content.

AFAIK everything that outputs editors content is hsc'd in css_styled_content

#2 Updated by Oliver Klee over 7 years ago

  • TYPO3 Version changed from 4.4 to 4.6
  • Patch is reviewed set to No
  • Has patch set to No

Steps to reproduce (on current master):

  1. Create a site that uses a normal TMENU.
  2. Create a page with the following title:
    ROFL <script>alert(1);</script>
  3. View the page in the FE

Expected results:
no pop-ups, the script code is visible in the menue

actual results:
2x the "1" popup

#3 Updated by Steffen Gebert over 7 years ago

  • Target version changed from 4.6.0 to 4.7.0
  • TYPO3 Version changed from 4.6 to 4.7

#4 Updated by Steffen Ritter almost 7 years ago

  • Target version changed from 4.7.0 to 4.7.1

#5 Updated by Steffen Ritter almost 7 years ago

  • Target version changed from 4.7.1 to 6.0.0
  • TYPO3 Version changed from 4.7 to 6.0

This is a change of behaviour which will lead to regressions in production sites, therefore I would like to only see that one in master

#6 Updated by Helmut Hummel over 6 years ago

  • Project changed from Core Security to TYPO3 Core

Moving this to the public issue tracker for discussion.

No need to handle that in secret

#7 Updated by Mathias Schreiber about 4 years ago

  • Target version changed from 6.0.0 to 7.2 (Frontend)
  • Is Regression set to No

#8 Updated by Benni Mack almost 4 years ago

  • Target version changed from 7.2 (Frontend) to 7.4 (Backend)

#9 Updated by Gerrit Code Review almost 4 years ago

  • Status changed from New to Under Review

Patch set 1 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at http://review.typo3.org/40260

#10 Updated by Benni Mack over 3 years ago

  • Status changed from Under Review to New

#11 Updated by Susanne Moog over 3 years ago

  • Target version changed from 7.4 (Backend) to 7.5

#12 Updated by Benni Mack over 3 years ago

  • Assignee set to Benni Mack
  • Target version changed from 7.5 to 8 LTS

#13 Updated by Riccardo De Contardi over 3 years ago

  • Category set to Content Rendering

#14 Updated by Benni Mack almost 2 years ago

  • Target version changed from 8 LTS to Candidate for Major Version

#15 Updated by Susanne Moog over 1 year ago

  • Category changed from Content Rendering to Frontend

#16 Updated by Riccardo De Contardi 9 months ago

just a note: this issue affects only menus built with HMENU/TMENU; if the menu is built via menuProcessor, it is not present.

#18 Updated by Georg Ringer 3 months ago

  • Assignee changed from Benni Mack to Georg Ringer

#19 Updated by Gerrit Code Review 3 months ago

  • Status changed from New to Under Review

Patch set 1 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/59333

#20 Updated by Susanne Moog 23 days ago

  • Status changed from Under Review to Accepted

Review not found.

Also available in: Atom PDF