Merge pull request from GHSA-fxwm-rx68-p5vx

ezsystems · Nov 25, 2021 · b6a0c93 · b6a0c93
1 parent a5c8333
commit b6a0c93
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 2 deletions.
diff --git a/src/bundle/Resources/public/js/OnlineEditor/buttons/ez-btn-customtag-update.js b/src/bundle/Resources/public/js/OnlineEditor/buttons/ez-btn-customtag-update.js
@@ -263,7 +263,12 @@ export default class EzBtnCustomTagUpdate extends EzWidgetButton {
      */
     createAttributes() {
         return Object.keys(this.attributes).reduce(
-            (total, attr) => `${total}<p>${this.attributes[attr].label}: ${this.state.values[attr].value}</p>`,
+            (total, attr) => {
+                const label = this.attributes[attr].label;
+                const value = window.eZ.helpers.text.escapeHTML(this.state.values[attr].value);
+
+                return `${total}<p>${label}: ${value}</p>`;
+            },
             ''
         );
     }

diff --git a/src/bundle/Resources/public/js/OnlineEditor/plugins/base/ez-custom-tag-base.js b/src/bundle/Resources/public/js/OnlineEditor/plugins/base/ez-custom-tag-base.js
@@ -203,7 +203,7 @@ const customTagBaseDefinition = {
             return;
         }
         const attributes = Object.keys(customTagConfig.attributes).reduce((total, attr) => {
-            const value = this.getConfig(attr);
+            const value = global.eZ.helpers.text.escapeHTML(this.getConfig(attr));
 
             return `${total}<p>${customTagConfig.attributes[attr].label}: ${value}</p>`;
         }, '');