Project

General

Profile

Actions
Copy link

Bug #75016

closed

Prevent XSS in fluid viewhelpern

Added by Nicole Cordes about 8 years ago. Updated over 6 years ago.

Status:
Closed
Priority:
Must have
Assignee:
Nicole Cordes
Category:
Fluid
Target version:
8.0
Start date:
2016-03-11
Due date:
% Done:

100%

Estimated time:
TYPO3 Version:
8
PHP Version:
Tags:
Complexity:
Is Regression:
No
Sprint Focus:
Stabilization Sprint

Description

There are some viewhelpers which miss to escape incoming variables and cause XSS entry points.

1. Set up a TYPO3 instance with current master
2. Include "fluid_stlyed_content" in root template
3. Create a content element of type "header"
4. Set the header field to "<script>alert('header xss');</script>"
5. Open page in frontend.

Actions
Copy link

Also available in: Atom PDF