CVE-2021-4084: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2021-12-10T12:15Z
Repository: https://github.com/pimcore/pimcore
Language: JavaScript
Files changed: bundles/AdminBundle/Resources/public/js/pimcore/object/classes/class.js
Commit date: 2021-12-09 12:53:00 +0100
Commit message: [Admin UI] DataObject Class - escape general settings input values (#10991)

* [Admin UI] DataObject Class - escape general settings input values

* Update bundles/AdminBundle/Resources/public/js/pimcore/object/classes/class.js

* [Admin UI] DataObject Class - escape general settings input values

* [Admin UI] DataObject Class - escape general settings input values
Diff: diff --git a/bundles/AdminBundle/Resources/public/js/pimcore/object/classes/class.js b/bundles/AdminBundle/Resources/public/js/pimcore/object/classes/class.js
index a712aa67ce3..ad66b07cb57 100644
--- a/bundles/AdminBundle/Resources/public/js/pimcore/object/classes/class.js
+++ b/bundles/AdminBundle/Resources/public/js/pimcore/object/classes/class.js
@@ -605,11 +605,16 @@ pimcore.object.classes.klass = Class.create({
                 });
 
                 for (var i = 0; i < items.length; i++) {
                     var item = items[i];
                     if (typeof item.getValue == "function") {
-                        this.data[item.name] = item.getValue();
+                        let value = item.getValue();
+                        if (typeof item.config.xtype !== 'undefined' && item.config.xtype === 'textfield') {
+                            value = Ext.util.Format.htmlEncode(value);
+                        }
+
+                        this.data[item.name] = value;
                     }
                 }
 
                 if (this.compositeIndicesPanel) {
                     this.collectCompositeIndices();
@@ -703,10 +708,11 @@ pimcore.object.classes.klass = Class.create({
 
         var iconField = new Ext.form.field.Text({
             id: "iconfield-" + this.getId(),
             name: "icon",
             width: 396,
+            renderer: Ext.util.Format.htmlEncode,
             value: this.data.icon,
             listeners: {
                 "afterrender": function (el) {
                     el.inputEl.applyStyles("background:url(" + el.getValue() + ") right center no-repeat;");
                 }
@@ -750,10 +756,11 @@ pimcore.object.classes.klass = Class.create({
                     fieldLabel: t("name"),
                     name: "name",
                     width: 500,
                     enableKeyEvents: true,
                     value: this.data.name,
+                    renderer: Ext.util.Format.htmlEncode,
                     listeners: {
                         keyup: function (el) {
                             this.rootPanel.getComponent("phpClassName").setValue(getPhpClassName(el.getValue()))
                         }.bind(this)
                     }
@@ -761,82 +768,93 @@ pimcore.object.classes.klass = Class.create({
                 {
                     xtype: "textarea",
                     fieldLabel: t("description"),
                     name: "description",
                     width: 500,
+                    renderer: Ext.util.Format.htmlEncode,
                     value: this.data.description
                 },
                 {
                     xtype: "textfield",
                     fieldLabel: t("unique_identifier"),
                     disabled: true,
+                    renderer: Ext.util.Format.htmlEncode,
                     value: this.data.id,
                     width: 500
                 },
                 {
                     xtype: "textfield",
                     fieldLabel: t("PHP Class Name"),
                     name: "phpClassName",
                     itemId: "phpClassName",
                     width: 500,
                     disabled: true,
+                    renderer: Ext.util.Format.htmlEncode,
                     value: getPhpClassName(this.data.name)
                 },
                 {
                     xtype: "textfield",
                     fieldLabel: t("parent_php_class"),
                     name: "parentClass",
                     width: 600,
+                    renderer: Ext.util.Format.htmlEncode,
                     value: this.data.parentClass
                 },
                 {
                     xtype: "textfield",
                     width: 600,
                     name: "implementsInterfaces",
                     fieldLabel: t("implements_interfaces"),
+                    renderer: Ext.util.Format.htmlEncode,
                     value: this.data.implementsInterfaces
                 },
                 {
                     xtype: "textfield",
                     fieldLabel: t("use_traits"),
                     name: "useTraits",
                     width: 600,
+                    renderer: Ext.util.Format.htmlEncode,
                     value: this.data.useTraits
                 },
                 {
                     xtype: "textfield",
                     fieldLabel: t("listing_parent_php_class"),
                     name: "listingParentClass",
                     width: 600,
+                    renderer: Ext.util.Format.htmlEncode,
                     value: this.data.listingParentClass
                 },
                 {
                     xtype: "textfield",
                     fieldLabel: t("listing_use_traits"),
                     name: "listingUseTraits",
                     width: 600,
+                    renderer: Ext.util.Format.htmlEncode,
                     value: this.data.listingUseTraits
                 },
                 {
                     xtype: "textfield",
                     fieldLabel: t("link_generator_reference"),
                     name: "linkGeneratorReference",
                     width: 600,
+                    renderer: Ext.util.Format.htmlEncode,
                     value: this.data.linkGeneratorReference
                 },
                 {
                     xtype: "textfield",
                     fieldLabel: t("preview_generator_reference"),
                     name: "previewGeneratorReference",
                     width: 600,
+                    renderer: Ext.util.Format.htmlEncode,
                     value: this.data.previewGeneratorReference
                 },
                 {
                     xtype: "textfield",
                     fieldLabel: t("preview_url"),
                     name: "previewUrl",
                     width: 600,
+                    renderer: Ext.util.Format.htmlEncode,
                     value: this.data.previewUrl
                 },
                 {
                     xtype: "fieldcontainer",
                     layout: "hbox",
@@ -883,10 +901,11 @@ pimcore.object.classes.klass = Class.create({
                 {
                     xtype: "textfield",
                     fieldLabel: t("group"),
                     name: "group",
                     width: 600,
+                    renderer: Ext.util.Format.htmlEncode,
                     value: this.data.group
                 },
                 this.allowInheritance,
                 this.allowVariants,
                 this.showVariants,

Vulnerable code:                         this.data[item.name] = item.getValue();
Fixed code:                         let value = item.getValue();
                        if (typeof item.config.xtype !== 'undefined' && item.config.xtype === 'textfield') {
                            value = Ext.util.Format.htmlEncode(value);
                        }

                        this.data[item.name] = value;
            renderer: Ext.util.Format.htmlEncode,
                    renderer: Ext.util.Format.htmlEncode,
                    renderer: Ext.util.Format.htmlEncode,
                    renderer: Ext.util.Format.htmlEncode,
                    renderer: Ext.util.Format.htmlEncode,
                    renderer: Ext.util.Format.htmlEncode,
                    renderer: Ext.util.Format.htmlEncode,
                    renderer: Ext.util.Format.htmlEncode,
                    renderer: Ext.util.Format.htmlEncode,
                    renderer: Ext.util.Format.htmlEncode,
                    renderer: Ext.util.Format.htmlEncode,
                    renderer: Ext.util.Format.htmlEncode,
                    renderer: Ext.util.Format.htmlEncode,
                    renderer: Ext.util.Format.htmlEncode,