Bug #95713: Reports module and html sanitizer is limiting output (icon, javascript...) - TYPO3 Core - TYPO3 Forge

Actions

Copy link

Bug #95713

closed

Reports module and html sanitizer is limiting output (icon, javascript...)

Added by Yohann CERDAN about 3 years ago. Updated about 2 years ago.

Status:

Closed

Priority:

Should have

Assignee:

Oliver Hader

Category:

Security

Target version:

Start date:

2021-10-20

Due date:

% Done:

100%

Estimated time:

TYPO3 Version:

PHP Version:

7.4

Tags:

Complexity:

Is Regression:

Yes

Sprint Focus:

Description

Hi,

I use to maintain a complex reporting extension who use "Reports" (https://extensions.typo3.org/extension/additional_reports).
Since typo3 v11, reports apply a global sanitize to the output like this :

typo3/sysext/reports/Resources/Private/Templates/Report/Detail.html
{content -> f:transform.html() -> f:sanitize.html()}

But this is limiting us A LOT in the output, for example :
- we cannot use IconFactory like <core:icon identifier="apps-pagetree-page-default" size="small" /> in our StandaloneView
- we cannot include any javascript in our StandaloneView (i use to have a mini menu that filter datas)

Everything will be encoded, is it possible to find a workarround for this?

Thanks

Related issues 2 (0 open — 2 closed)

Actions

Copy link

Updated by Oliver Hader about 3 years ago

Status changed from New to Needs Feedback

Can you please point me to corresponding parts on GitHub that trigger those kind of markup?

Actions

Copy link

Updated by Oliver Hader about 3 years ago

Related to Bug #95179: Transform internal URIs in backend user interface added

Actions

Copy link

Updated by Oliver Hader about 3 years ago

The only possibility I see is to remove -> f:sanitize.html() from corresponding template, introduced in https://review.typo3.org/c/Packages/TYPO3.CMS/+/71020/4/typo3/sysext/reports/Resources/Private/Templates/Report/Detail.html

Allowing <script> or similar with typo3/html-sanitizer does not make much sense and contradicts the aim to mitigate potential cross-site scripting occurrences.

In order to be compatible with future content-security-policy headers, I'd suggest to

avoid inline SVG, but use <img src="icon.svg"> instead
avoid inline JavaScript, but use a dedicated ES6 module (or RequireJS module) instead

Actions

Copy link

Updated by Gerrit Code Review about 3 years ago

Status changed from Needs Feedback to Under Review

Patch set 1 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/71903

Actions

Copy link

Updated by Yohann CERDAN about 3 years ago

Oliver Hader wrote in #note-3:

The only possibility I see is to remove -> f:sanitize.html() from corresponding template, introduced in https://review.typo3.org/c/Packages/TYPO3.CMS/+/71020/4/typo3/sysext/reports/Resources/Private/Templates/Report/Detail.html

Allowing <script> or similar with typo3/html-sanitizer does not make much sense and contradicts the aim to mitigate potential cross-site scripting occurrences.

In order to be compatible with future content-security-policy headers, I'd suggest to

avoid inline SVG, but use <img src="icon.svg"> instead

avoid inline JavaScript, but use a dedicated ES6 module (or RequireJS module) instead

Ok, for the <img src="icon.svg"> thats what i do but that's a shame we cannot use viewhelpers here.

And for the javascript, i agree too, BUT, i cannot add input,select,form,etc... to make my menu. The problem is the same here, we are very limited (in reports module of course).

Actions

Copy link