Issue #1308: Fix possible js injection in dynamic field error messages.

* WIP Execute Translate and html via Template * Using another jQuery function to extract text * Improved data handling * Improved data handling in previously forgotten files
RotherOSS · Oct 8, 2021 · 741a845 · 741a845
1 parent b323248
commit 741a845
Show file tree

Hide file tree

Showing 11 changed files with 61 additions and 20 deletions.
diff --git a/Kernel/System/DynamicField/Driver/BaseDatabase.pm b/Kernel/System/DynamicField/Driver/BaseDatabase.pm
@@ -360,7 +360,12 @@ EOF
 
     if ( $Param{ServerError} ) {
 
-        my $ErrorMessage = $Param{ErrorMessage} || 'This field is required.';
+        my $ErrorMessage = $Param{LayoutObject}->Output(
+            'Template'  => '[% Translate(Data.ErrorMessage) | html %]',
+            'Data'      => {
+                'ErrorMessage'  => $Param{ErrorMessage} || 'This field is required.',
+            }
+        );
         my $DivID        = $FieldName . 'ServerError';
 
         my $FieldRequiredMessage = $Param{LayoutObject}->{LanguageObject}->Translate($ErrorMessage);

diff --git a/Kernel/System/DynamicField/Driver/BaseDateTime.pm b/Kernel/System/DynamicField/Driver/BaseDateTime.pm
@@ -285,8 +285,12 @@ EOF
 
     if ( $Param{ServerError} ) {
 
-        my $ErrorMessage = $Param{ErrorMessage} || 'This field is required.';
-        $ErrorMessage = $Param{LayoutObject}->{LanguageObject}->Translate($ErrorMessage);
+        my $ErrorMessage = $Param{LayoutObject}->Output(
+            'Template'  => '[% Translate(Data.ErrorMessage) | html %]',
+            'Data'      => {
+                'ErrorMessage'  => $Param{ErrorMessage} || 'This field is required.',
+            }
+        );
         my $DivID = $FieldName . 'UsedServerError';
 
         # for server side validation

diff --git a/Kernel/System/DynamicField/Driver/BaseSelect.pm b/Kernel/System/DynamicField/Driver/BaseSelect.pm
@@ -267,8 +267,12 @@ EOF
 
     if ( $Param{ServerError} ) {
 
-        my $ErrorMessage = $Param{ErrorMessage} || 'This field is required.';
-        $ErrorMessage = $Param{LayoutObject}->{LanguageObject}->Translate($ErrorMessage);
+        my $ErrorMessage = $Param{LayoutObject}->Output(
+            'Template'  => '[% Translate(Data.ErrorMessage) | html %]',
+            'Data'      => {
+                'ErrorMessage'  => $Param{ErrorMessage} || 'This field is required.',
+            }
+        );
         my $DivID = $FieldName . 'ServerError';
 
         # for server side validation

diff --git a/Kernel/System/DynamicField/Driver/BaseText.pm b/Kernel/System/DynamicField/Driver/BaseText.pm
@@ -252,8 +252,12 @@ EOF
 
     if ( $Param{ServerError} ) {
 
-        my $ErrorMessage = $Param{ErrorMessage} || 'This field is required.';
-        $ErrorMessage = $Param{LayoutObject}->{LanguageObject}->Translate($ErrorMessage);
+        my $ErrorMessage = $Param{LayoutObject}->Output(
+            'Template'  => '[% Translate(Data.ErrorMessage) | html %]',
+            'Data'      => {
+                'ErrorMessage'  => $Param{ErrorMessage} || 'This field is required.',
+            }
+        );
         my $DivID = $FieldName . 'ServerError';
 
         # for server side validation

diff --git a/Kernel/System/DynamicField/Driver/Checkbox.pm b/Kernel/System/DynamicField/Driver/Checkbox.pm
@@ -342,8 +342,12 @@ EOF
 
     if ( $Param{ServerError} ) {
 
-        my $ErrorMessage = $Param{ErrorMessage} || 'This field is required.';
-        $ErrorMessage = $Param{LayoutObject}->{LanguageObject}->Translate($ErrorMessage);
+        my $ErrorMessage = $Param{LayoutObject}->Output(
+            'Template'  => '[% Translate(Data.ErrorMessage) | html %]',
+            'Data'      => {
+                'ErrorMessage'  => $Param{ErrorMessage} || 'This field is required.',
+            }
+        );
         my $DivID = $FieldName . 'ServerError';
 
         # for server side validation

diff --git a/Kernel/System/DynamicField/Driver/ContactWD.pm b/Kernel/System/DynamicField/Driver/ContactWD.pm
@@ -262,8 +262,12 @@ EOF
 
     if ( $Param{ServerError} ) {
 
-        my $ErrorMessage = $Param{ErrorMessage} || 'This field is required.';
-        $ErrorMessage = $Param{LayoutObject}->{LanguageObject}->Translate($ErrorMessage);
+        my $ErrorMessage = $Param{LayoutObject}->Output(
+            'Template'  => '[% Translate(Data.ErrorMessage) | html %]',
+            'Data'      => {
+                'ErrorMessage'  => $Param{ErrorMessage} || 'This field is required.',
+            }
+        );
         my $DivID = $FieldName . 'ServerError';
 
         # for server side validation

diff --git a/Kernel/System/DynamicField/Driver/Date.pm b/Kernel/System/DynamicField/Driver/Date.pm
@@ -381,8 +381,12 @@ EOF
 
     if ( $Param{ServerError} ) {
 
-        my $ErrorMessage = $Param{ErrorMessage} || 'This field is required.';
-        $ErrorMessage = $Param{LayoutObject}->{LanguageObject}->Translate($ErrorMessage);
+        my $ErrorMessage = $Param{LayoutObject}->Output(
+            'Template'  => '[% Translate(Data.ErrorMessage) | html %]',
+            'Data'      => {
+                'ErrorMessage'  => $Param{ErrorMessage} || 'This field is required.',
+            }
+        );
         my $DivID = $FieldName . 'UsedServerError';
 
         # for server side validation

diff --git a/Kernel/System/DynamicField/Driver/Multiselect.pm b/Kernel/System/DynamicField/Driver/Multiselect.pm
@@ -396,8 +396,12 @@ EOF
 
     if ( $Param{ServerError} ) {
 
-        my $ErrorMessage = $Param{ErrorMessage} || 'This field is required.';
-        $ErrorMessage = $Param{LayoutObject}->{LanguageObject}->Translate($ErrorMessage);
+        my $ErrorMessage = $Param{LayoutObject}->Output(
+            'Template'  => '[% Translate(Data.ErrorMessage) | html %]',
+            'Data'      => {
+                'ErrorMessage'  => $Param{ErrorMessage} || 'This field is required.',
+            }
+        );
         my $DivID = $FieldName . 'ServerError';
 
         # for server side validation

diff --git a/Kernel/System/DynamicField/Driver/TextArea.pm b/Kernel/System/DynamicField/Driver/TextArea.pm
@@ -209,8 +209,12 @@ EOF
 
     if ( $Param{ServerError} ) {
 
-        my $ErrorMessage = $Param{ErrorMessage} || 'This field is required.';
-        $ErrorMessage = $Param{LayoutObject}->{LanguageObject}->Translate($ErrorMessage);
+        my $ErrorMessage = $Param{LayoutObject}->Output(
+            'Template'  => '[% Translate(Data.ErrorMessage) | html %]',
+            'Data'      => {
+                'ErrorMessage'  => $Param{ErrorMessage} || 'This field is required.',
+            }
+        );
         my $DivID = $FieldName . 'ServerError';
 
         # for server side validation

diff --git a/Kernel/System/DynamicField/Driver/WebService.pm b/Kernel/System/DynamicField/Driver/WebService.pm
@@ -359,8 +359,12 @@ EOF
 
     if ( $Param{ServerError} ) {
 
-        my $ErrorMessage = $Param{ErrorMessage} || 'This field is required.';
-        $ErrorMessage = $Param{LayoutObject}->{LanguageObject}->Translate($ErrorMessage);
+        my $ErrorMessage = $Param{LayoutObject}->Output(
+            'Template'  => '[% Translate(Data.ErrorMessage) | html %]',
+            'Data'      => {
+                'ErrorMessage'  => $Param{ErrorMessage} || 'This field is required.',
+            }
+        );
         my $DivID = $FieldName . 'ServerError';
 
         # For server side validation.

diff --git a/var/httpd/htdocs/js/Core.Form.Validate.js b/var/httpd/htdocs/js/Core.Form.Validate.js
@@ -141,7 +141,7 @@ Core.Form.Validate = (function (TargetNS) {
         // Get the target element and find the associated hidden div with the
         // error message.
         InputErrorMessageHTML = $('#' + Core.App.EscapeSelector($Element.attr('id')) + ErrorType).html();
-        InputErrorMessageText = $('#' + Core.App.EscapeSelector($Element.attr('id')) + ErrorType).text();
+        InputErrorMessageText = $('#' + Core.App.EscapeSelector($Element.attr('id')) + ErrorType + ' > p').first().html();
 
         if (InputErrorMessageHTML && InputErrorMessageHTML.length) {
             // If error field is a RTE, it is a little bit more difficult.