CVE-2023-1116: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.18.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-03-01T14:15Z
Repository: https://github.com/pimcore/pimcore
Language: JavaScript
Files changed: bundles/AdminBundle/Controller/Admin/EmailController.php, bundles/AdminBundle/Resources/public/js/pimcore/helpers.js, bundles/AdminBundle/Resources/public/js/pimcore/settings/email/blacklist.js
Commit date: 2023-02-27 16:16:32 +0100
Commit message: [Task] Optimized blacklist email input (#14467)

* optimized email input

* added filter for email address

* fixed typo
Diff: diff --git a/bundles/AdminBundle/Controller/Admin/EmailController.php b/bundles/AdminBundle/Controller/Admin/EmailController.php
index e9c5f6d1124c..5d97c4454d56 100644
--- a/bundles/AdminBundle/Controller/Admin/EmailController.php
+++ b/bundles/AdminBundle/Controller/Admin/EmailController.php
@@ -456,12 +456,16 @@ class EmailController extends AdminController
 
         if ($request->get('data')) {
             $data = $this->decodeJson($request->get('data'));
 
             if (is_array($data)) {
-                foreach ($data as &$value) {
+                foreach ($data as $key => &$value) {
                     if (is_string($value)) {
+                        if($key === 'address'){
+                            $value = filter_var($value, FILTER_SANITIZE_EMAIL);
+                        }
+
                         $value = trim($value);
                     }
                 }
             }
 
diff --git a/bundles/AdminBundle/Resources/public/js/pimcore/helpers.js b/bundles/AdminBundle/Resources/public/js/pimcore/helpers.js
index d29a765c97b3..af7c28f795ad 100644
--- a/bundles/AdminBundle/Resources/public/js/pimcore/helpers.js
+++ b/bundles/AdminBundle/Resources/public/js/pimcore/helpers.js
@@ -12,10 +12,14 @@
  */
 
 /*global localStorage */
 pimcore.registerNS("pimcore.helpers.x");
 
+pimcore.helpers.sanitizeEmail = function (email) {
+    return email.replace(/[^a-zA-Z0-9_\-@.+]/g,'');
+};
+
 pimcore.helpers.registerKeyBindings = function (bindEl, ExtJS) {
 
     if (!ExtJS) {
         ExtJS = Ext;
     }
diff --git a/bundles/AdminBundle/Resources/public/js/pimcore/settings/email/blacklist.js b/bundles/AdminBundle/Resources/public/js/pimcore/settings/email/blacklist.js
index 0c1beb295d4c..018fd93eba13 100644
--- a/bundles/AdminBundle/Resources/public/js/pimcore/settings/email/blacklist.js
+++ b/bundles/AdminBundle/Resources/public/js/pimcore/settings/email/blacklist.js
@@ -121,13 +121,19 @@ pimcore.settings.email.blacklist = Class.create({
                     {
                         tooltip:t('delete'),
                         icon:"/bundles/pimcoreadmin/img/flat-color-icons/delete.svg",
                         handler:function (grid, rowIndex) {
                             let data = grid.getStore().getAt(rowIndex);
-                            pimcore.helpers.deleteConfirm(t('email_blacklist'), data.data.address, function () {
-                                grid.getStore().removeAt(rowIndex);
-                            }.bind(this));
+                            const sanitizedEmail = pimcore.helpers.sanitizeEmail(data.data.address);
+
+                            pimcore.helpers.deleteConfirm(
+                                t('email_blacklist'),
+                                sanitizedEmail,
+                                function () {
+                                    grid.getStore().removeAt(rowIndex);
+                                }.bind(this)
+                            );
                         }.bind(this)
                     }
                 ]
             }
         ];
@@ -183,12 +189,14 @@ pimcore.settings.email.blacklist = Class.create({
 
 
     onAdd:function (btn, ev) {
         Ext.MessageBox.prompt("", t("email_address"), function (button, value) {
             if(button == "ok") {
+                const sanitizedEmail = pimcore.helpers.sanitizeEmail(value);
+
                 var u = {
-                    "address": value
+                    "address": sanitizedEmail
                 };
 
                 this.grid.store.insert(0, u);
             }
 

Vulnerable code:                 foreach ($data as &$value) {
                            pimcore.helpers.deleteConfirm(t('email_blacklist'), data.data.address, function () {
                                grid.getStore().removeAt(rowIndex);
                            }.bind(this));
                    "address": value
Fixed code:                 foreach ($data as $key => &$value) {
                        if($key === 'address'){
                            $value = filter_var($value, FILTER_SANITIZE_EMAIL);
                        }

pimcore.helpers.sanitizeEmail = function (email) {
    return email.replace(/[^a-zA-Z0-9_\-@.+]/g,'');
};

                            const sanitizedEmail = pimcore.helpers.sanitizeEmail(data.data.address);

                            pimcore.helpers.deleteConfirm(
                                t('email_blacklist'),
                                sanitizedEmail,
                                function () {
                                    grid.getStore().removeAt(rowIndex);
                                }.bind(this)
                            );
                const sanitizedEmail = pimcore.helpers.sanitizeEmail(value);

                    "address": sanitizedEmail