From f311198e8ecf687c0217749d07abebaf93a3152a Mon Sep 17 00:00:00 2001
From: Gabe Troyan <gabe+typo3org@ecopixel.com>
Date: Tue, 14 Jun 2022 09:11:32 +0200
Subject: [PATCH] [SECURITY] Ensure text preview of multivalue items in form
editor
Multivalue items in the form editor user interface were previewed
as HTML, but should be treated as scalar text only.
Resolves: #96743
Releases: main, 11.5, 10.4
Change-Id: I5e8dab26119490ecf19ac5d48c2bc7a5a00daaad
Security-Bulletin: TYPO3-CORE-SA-2022-003
Security-References: CVE-2022-31048
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/74894
Tested-by: Oliver Hader <oliver.hader@typo3.org>
Reviewed-by: Oliver Hader <oliver.hader@typo3.org>
---
.../JavaScript/Backend/FormEditor/StageComponent.js | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/typo3/sysext/form/Resources/Public/JavaScript/Backend/FormEditor/StageComponent.js b/typo3/sysext/form/Resources/Public/JavaScript/Backend/FormEditor/StageComponent.js
index 7f9f99cb5fa9..3ae7323a7aa8 100644
--- a/typo3/sysext/form/Resources/Public/JavaScript/Backend/FormEditor/StageComponent.js
+++ b/typo3/sysext/form/Resources/Public/JavaScript/Backend/FormEditor/StageComponent.js
@@ -455,10 +455,10 @@ define(['jquery',
*/
function setStageHeadline(title) {
if (getUtility().isUndefinedOrNull(title)) {
- title = buildTitleByFormElement();
+ title = buildTitleByFormElement().text();
}
- $(getHelper().getDomElementDataIdentifierSelector('stageHeadline')).html(title);
+ $(getHelper().getDomElementDataIdentifierSelector('stageHeadline')).text(title);
};
/**
@@ -923,10 +923,10 @@ define(['jquery',
getHelper()
.getTemplatePropertyDomElement('_type', template)
- .append(formElement.get('type'));
+ .append(document.createTextNode(getFormElementDefinition(formElement, 'type')));
getHelper()
.getTemplatePropertyDomElement('_identifier', template)
- .append(formElement.get('identifier'));
+ .append(document.createTextNode(formElement.get('identifier')));
};
/**
@@ -971,7 +971,7 @@ define(['jquery',
getHelper()
.getTemplatePropertyDomElement('_label', rowTemplate)
- .append(collectionElementConfiguration['label']);
+ .append(document.createTextNode(collectionElementConfiguration['label']));
$(getHelper().getDomElementDataIdentifierSelector('validatorsContainer'), $(template))
.append(rowTemplate.html());
}
@@ -1031,7 +1031,7 @@ define(['jquery',
}
}
- getHelper().getTemplatePropertyDomElement('_label', rowTemplate).append(label);
+ getHelper().getTemplatePropertyDomElement('_label', rowTemplate).append(document.createTextNode(label));
if (isPreselected) {
getHelper().getTemplatePropertyDomElement('_label', rowTemplate).addClass(
--
GitLab