Bug #82054
Updated by Oliver Hader over 6 years ago
The Fluid view-helper f:link.external directly uses the given URI without further sanitizing it as a link. In the TYPO3 core we strip away @javascript:@ and @data:@ URI schemes. This has been integrated into @ContentObjectRender::typoLink@ with the following security bulletin https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-012/ Payload: * @<f:link.external uri="{uri}" target="_blank">Some link</f:link.external>@ * @uri@ variable containing @javascript:alert('XSS')@ ELTS effects: 4.5, 6.2