Fix: XSS vulnerability in some module titles

fisharebest · Sep 15, 2021 · a743d8a · a743d8a
1 parent 698f970
commit a743d8a
Show file tree

Hide file tree

Showing 3 changed files with 4 additions and 4 deletions.
diff --git a/app/Module/HtmlBlockModule.php b/app/Module/HtmlBlockModule.php
@@ -108,7 +108,7 @@ public function getBlock(Tree $tree, int $block_id, string $context, array $conf
                 'block'      => Str::kebab($this->name()),
                 'id'         => $block_id,
                 'config_url' => $this->configUrl($tree, $context, $block_id),
-                'title'      => $title,
+                'title'      => e($title),
                 'content'    => $content,
             ]);
         }

diff --git a/app/Module/UserWelcomeModule.php b/app/Module/UserWelcomeModule.php
@@ -117,7 +117,7 @@ public function getBlock(Tree $tree, int $block_id, string $context, array $conf
         ];
         $content = view('modules/user_welcome/welcome', ['links' => $links]);
 
-        $real_name = '<bdi>' . e(Auth::user()->realName()) . '</bdi>';
+        $real_name = "\u{2068}" . e(Auth::user()->realName()) . "\u{2069}";
 
         /* I18N: A %s is the user’s name */
         $title = I18N::translate('Welcome %s', $real_name);
@@ -127,7 +127,7 @@ public function getBlock(Tree $tree, int $block_id, string $context, array $conf
                 'block'      => Str::kebab($this->name()),
                 'id'         => $block_id,
                 'config_url' => '',
-                'title'      => $title,
+                'title'      => e($title),
                 'content'    => $content,
             ]);
         }

diff --git a/app/Module/WelcomeBlockModule.php b/app/Module/WelcomeBlockModule.php
@@ -123,7 +123,7 @@ public function getBlock(Tree $tree, int $block_id, string $context, array $conf
                 'block'      => Str::kebab($this->name()),
                 'id'         => $block_id,
                 'config_url' => '',
-                'title'      => $individual->tree()->title(),
+                'title'      => e($individual->tree()->title()),
                 'content'    => $content,
             ]);
         }