Project

General

Profile

Actions

Bug #94786

closed

Bug #94787: Tracking issue related to HTML sanitization issues

Relax behavior of HTML sanitization

Added by Oliver Hader over 2 years ago. Updated over 2 years ago.

Status:
Closed
Priority:
Should have
Assignee:
Category:
Security
Target version:
-
Start date:
2021-08-10
Due date:
% Done:

100%

Estimated time:
TYPO3 Version:
9
PHP Version:
Tags:
Complexity:
Is Regression:
Yes
Sprint Focus:

Description

Related to https://typo3.org/security/advisory/typo3-core-sa-2021-013

Currently property lib.parseFunc.htmlSanitize = 1 is enforced, in case the behavior has not been explicitly disabled.

The idea is to relax the behavior a bit, by target the actual use-cases:

  • f:format.html view-helper (using new attribute, being enabled per default)
  • RTE-related invocation of stdWrap.parseFunc (no idea yet, how to tackle)

Related issues 2 (0 open2 closed)

Related to TYPO3 Core - Task #96520: Enforce non-empty configuration in ContentObjectRenderer::parseFuncClosed2022-01-12

Actions
Related to TYPO3 Core - Task #96831: Drop html-sanitizer fall-back behavior in parseFuncClosed2022-02-11

Actions
Actions #1

Updated by Oliver Hader over 2 years ago

  • Description updated (diff)
Actions #2

Updated by Gerrit Code Review over 2 years ago

  • Status changed from New to Under Review

Patch set 1 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/70404

Actions #3

Updated by Oliver Hader over 2 years ago

  • Parent task set to #94787
Actions #4

Updated by Gerrit Code Review over 2 years ago

Patch set 2 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/70404

Actions #5

Updated by Gerrit Code Review over 2 years ago

Patch set 3 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/70404

Actions #6

Updated by Gerrit Code Review over 2 years ago

Patch set 4 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/70404

Actions #7

Updated by Gerrit Code Review over 2 years ago

Patch set 5 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/70404

Actions #8

Updated by Gerrit Code Review over 2 years ago

Patch set 6 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/70404

Actions #9

Updated by Gerrit Code Review over 2 years ago

Patch set 7 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/70404

Actions #10

Updated by Gerrit Code Review over 2 years ago

Patch set 1 for branch 10.4 of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/70537

Actions #11

Updated by Gerrit Code Review over 2 years ago

Patch set 2 for branch 10.4 of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/70537

Actions #12

Updated by Gerrit Code Review over 2 years ago

Patch set 1 for branch 9.5 of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/70588

Actions #13

Updated by Gerrit Code Review over 2 years ago

Patch set 3 for branch 10.4 of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/70537

Actions #14

Updated by Gerrit Code Review over 2 years ago

Patch set 4 for branch 10.4 of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/70537

Actions #15

Updated by Gerrit Code Review over 2 years ago

Patch set 1 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/70600

Actions #16

Updated by Gerrit Code Review over 2 years ago

Patch set 2 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/70600

Actions #17

Updated by Gerrit Code Review over 2 years ago

Patch set 3 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/70600

Actions #18

Updated by Gerrit Code Review over 2 years ago

Patch set 4 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/70600

Actions #19

Updated by Gerrit Code Review over 2 years ago

Patch set 5 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/70600

Actions #20

Updated by Gerrit Code Review over 2 years ago

Patch set 8 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/70404

Actions #21

Updated by Gerrit Code Review over 2 years ago

Patch set 5 for branch 10.4 of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/70537

Actions #22

Updated by Gerrit Code Review over 2 years ago

Patch set 2 for branch 9.5 of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/70588

Actions #23

Updated by Gerrit Code Review over 2 years ago

Patch set 1 for branch 11.3 of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/70612

Actions #24

Updated by Gerrit Code Review over 2 years ago

Patch set 6 for branch 10.4 of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/70537

Actions #25

Updated by Gerrit Code Review over 2 years ago

Patch set 3 for branch 9.5 of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/70588

Actions #26

Updated by Oliver Hader over 2 years ago

  • Status changed from Under Review to Resolved
  • % Done changed from 0 to 100
Actions #27

Updated by Benni Mack over 2 years ago

  • Status changed from Resolved to Closed
Actions #28

Updated by Oliver Hader about 2 years ago

  • Related to Task #96520: Enforce non-empty configuration in ContentObjectRenderer::parseFunc added
Actions #29

Updated by Oliver Hader about 2 years ago

  • Related to Task #96831: Drop html-sanitizer fall-back behavior in parseFunc added
Actions

Also available in: Atom PDF