vulnerability to XSS

[rbartczak]

We have received information from our security team about an XSS vulnerability (e.g. session stealing).
I can see in the code that there is information about XSS security.

Have you tested xss vulnerabilities?

[nilsteampassnet]

It is regularly tested by external as I receive possible CVEs details.
Most of time they are related to version 2.x which is not maintened anymore.
Very few of them concerns version 3.x for which security is taken into account from design.
I then solves them once fix identified.
But personnaly I don't perform such tests.

But please provide me what your security team shared with you.

[rbartczak]

Hello,

Is it possible to add xss filtering (e.g. xss_clean) for fields that are displayed to other users (username, email address, item name, etc)

[nilsteampassnet]

All fields are already sanitized using Elegantweb/sanitize library which relies on PHP htmlspecialchars() function.

[rbartczak]

Hello,

Thank you for your answer. Maybe I need to enable something, install some server-side extension?
For me, I can enter xss/scripts in the fields

[gamblerpentest]

I'm bumping and confirm issue with this topic. In the text field where the user can change the name/surname, is still an error that allows the execution of the XSS script (confirming what rbartczak wrote).
Applies to version 3.x.

[rbartczak]

Hello,

Thank you very much for implementing DOMPurify, great job!

Is it possible to include the Label/Login field when creating a new item?

[rbartczak]

Same request in folder name/label.
really thanks a lot for your support

[nilsteampassnet]

@rbartczak
it is the case already. I have added DOMPurify on all text fields.

[Saibamen]

Please retest in 3.0.7 and close if fixed