CVE-2022-2796: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.4.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 4.8
Published: 2022-08-23T08:15Z
Repository: https://github.com/pimcore/pimcore
Language: JavaScript
Files changed: bundles/AdminBundle/Resources/public/js/pimcore/settings/translation.js
Commit date: 2022-08-22 10:49:22 +0200
Commit message: [Admin] Translations - properly escape key on roweditor

Diff: diff --git a/bundles/AdminBundle/Resources/public/js/pimcore/settings/translation.js b/bundles/AdminBundle/Resources/public/js/pimcore/settings/translation.js
index 9346032a8741..52570a30b9ff 100644
--- a/bundles/AdminBundle/Resources/public/js/pimcore/settings/translation.js
+++ b/bundles/AdminBundle/Resources/public/js/pimcore/settings/translation.js
@@ -245,11 +245,14 @@ pimcore.settings.translation.domain = Class.create({
             {name: 'creationDate', type: 'date', convert: dateConverter, persist: false},
             {name: 'modificationDate', type: 'date', convert: dateConverter, persist: false}
         ];
 
         var typesColumns = [
-            {text: t("key"), sortable: true, dataIndex: 'key', flex: 1, editable: false, filter: 'string'},
+            {text: t("key"), sortable: true, dataIndex: 'key', flex: 1, editable: false, filter: 'string',
+                editor: new Ext.form.DisplayField({
+                    htmlEncode: true
+                })},
             {text: t("type"), sortable: true, dataIndex: 'type', width: 100, editor: new Ext.form.ComboBox({
                     triggerAction: 'all',
                     editable: false,
                     store: [["simple", t('translation_simple')],["custom", t('translation_custom')]]
                 }),
@@ -313,11 +316,11 @@ pimcore.settings.translation.domain = Class.create({
                 items: [{
                     tooltip: t('delete'),
                     icon: "/bundles/pimcoreadmin/img/flat-color-icons/delete.svg",
                     handler: function (grid, rowIndex) {
                         let data = grid.getStore().getAt(rowIndex);
-                        pimcore.helpers.deleteConfirm(t('translation'), data.data.key, function () {
+                        pimcore.helpers.deleteConfirm(t('translation'), Ext.util.Format.htmlEncode(data.data.key), function () {
                             grid.getStore().removeAt(rowIndex);
                         }.bind(this));
                     }.bind(this)
                 }]
             });

Vulnerable code:             {text: t("key"), sortable: true, dataIndex: 'key', flex: 1, editable: false, filter: 'string'},
                        pimcore.helpers.deleteConfirm(t('translation'), data.data.key, function () {
Fixed code:             {text: t("key"), sortable: true, dataIndex: 'key', flex: 1, editable: false, filter: 'string',
                editor: new Ext.form.DisplayField({
                    htmlEncode: true
                })},
                        pimcore.helpers.deleteConfirm(t('translation'), Ext.util.Format.htmlEncode(data.data.key), function () {