FIX HTMLEditorField is not able to show html or xml code examples #11243
Conversation
sabina-talipova
force-pushed
the
pulls/5.2/fix-htmlentities-issue
branch
6 times, most recently
from
4793ef7 to
c766766
Compare
| if ($matches[0] != '&') { | ||
| return str_replace($matches[0], htmlentities($matches[0], ENT_COMPAT, 'UTF-8', true), $matches[0]); | ||
| } else { | ||
| return str_replace($matches[0], htmlentities($matches[0], ENT_COMPAT, 'UTF-8', false), $matches[0]); | ||
| } |
There was a problem hiding this comment.
| if ($matches[0] != '&') { | |
| return str_replace($matches[0], htmlentities($matches[0], ENT_COMPAT, 'UTF-8', true), $matches[0]); | |
| } else { | |
| return str_replace($matches[0], htmlentities($matches[0], ENT_COMPAT, 'UTF-8', false), $matches[0]); | |
| } | |
| $doubleEncode = $matches[0] !== '&' | |
| return htmlentities($matches[0], ENT_COMPAT, 'UTF-8', $doubleEncode); |
sabina-talipova
force-pushed
the
pulls/5.2/fix-htmlentities-issue
branch
from
c766766 to
ca911b1
Compare
| @@ -3,6 +3,6 @@ | |||
| > | |||
| {$Content} | |||
| <% if $Arguments.caption %> | |||
| <p class="caption">{$Arguments.caption}</p> | |||
| <p class="caption">{$Arguments.caption.RAW}</p> | |||
There was a problem hiding this comment.
Why is this changing?
Wouldn't .RAW allow XSS to be added to the caption field and then executed by whoever looks at it?
There was a problem hiding this comment.
What happens if the caption contains an
&?
Sorry, I haven't replied. I added this to avoid double encoding for & in caption in Embed short codes.
We convert all characters to HTML entities before save data in DB.
Wouldn't .RAW allow XSS to be added to the caption field and then executed by whoever looks a
I'm not sure 100%, but I check another fields where we use RAW method and I also did few XSS tests with string contains javascript.
Just in case, return this back to encode string again: https://github.com/silverstripe/silverstripe-framework/pull/11243/files#diff-d0d2867af6bff9ad7e4ced04d5491feea4b4efec408b6e96b37e4f5eb46914ecR174-R175.
It's not necessary, probably.
sabina-talipova
force-pushed
the
pulls/5.2/fix-htmlentities-issue
branch
from
ca911b1 to
7b44526
Compare
sabina-talipova
force-pushed
the
pulls/5.2/fix-htmlentities-issue
branch
from
7b44526 to
bc46c23
Compare
Description
Additional condition to avoid double ampersand encoding.
Parent issue