CVE-2022-0509: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.3.1.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-02-08T12:15Z
Repository: https://github.com/pimcore/pimcore
Language: JavaScript
Files changed: bundles/AdminBundle/Resources/public/js/pimcore/settings/website.js
Commit date: 2022-02-07 13:03:58 +0100
Commit message: [Admin] Website Settings - Escape grid values properly

Diff: diff --git a/bundles/AdminBundle/Resources/public/js/pimcore/settings/website.js b/bundles/AdminBundle/Resources/public/js/pimcore/settings/website.js
index b522d6fd2d3..f19115b0e41 100644
--- a/bundles/AdminBundle/Resources/public/js/pimcore/settings/website.js
+++ b/bundles/AdminBundle/Resources/public/js/pimcore/settings/website.js
@@ -34,11 +34,11 @@ pimcore.settings.website = Class.create({
                 title: t('website_settings'),
                 iconCls: "pimcore_icon_website_settings",
                 border:false,
                 layout:"fit",
                 closable:true,
-                items:[this.getRowEditor()]
+                items:[this.getRowEditor()],
             });
 
             var tabPanel = Ext.getCmp("pimcore_panel_tabs");
             tabPanel.add(this.panel);
             tabPanel.setActiveItem("pimcore_website_settings");
@@ -131,10 +131,11 @@ pimcore.settings.website = Class.create({
             {
                 text: t("value"),
                 dataIndex: 'data',
                 flex: 300,
                 editable: true,
+                editor: new Ext.form.TextField({}),
                 renderer: this.getCellRenderer.bind(this),
             },
             {text: t("site"), flex: 100, sortable:true, dataIndex: "siteId",
                 editor: new Ext.form.ComboBox({
                     store: pimcore.globalmanager.get("sites"),
@@ -301,11 +302,14 @@ pimcore.settings.website = Class.create({
             columnLines:true,
             trackMouseOver:true,
             bodyCls: "pimcore_editable_grid",
             stripeRows:true,
             columns : {
-                items: typesColumns
+                items: typesColumns,
+                defaults: {
+                    renderer: Ext.util.Format.htmlEncode
+                },
             },
             sm:  Ext.create('Ext.selection.RowModel', {}),
             bbar:this.pagingtoolbar,
             plugins: [
                 this.rowEditing
@@ -357,19 +361,27 @@ pimcore.settings.website = Class.create({
 
         return '<div class="pimcore_icon_' + value + '" data-id="' + record.get("id") + '">&nbsp;</div>';
     },
 
     getCellEditor: function (record) {
-        var data = record.data;
+        let data = record.data;
 
-        var type = data.type;
-        var property;
+        let type = data.type;
+        let property;
 
         if (type === "text") {
-            property = Ext.create('Ext.form.TextField');
+            property = {
+                xtype: 'textfield',
+                flex: 1,
+                value: data.data
+            }
         } else if (type == "textarea") {
-            property = Ext.create('Ext.form.TextArea');
+            property = {
+                xtype: "textarea",
+                flex: 1,
+                value: data.data
+            }
         } else if (type == "document" || type == "asset" || type == "object") {
             property = {
                 xtype: 'textfield',
                 editable: false,
                 id: 'valueEditor',

Vulnerable code:                 items:[this.getRowEditor()]
                items: typesColumns
        var data = record.data;
        var type = data.type;
        var property;
            property = Ext.create('Ext.form.TextField');
            property = Ext.create('Ext.form.TextArea');
Fixed code:                 items:[this.getRowEditor()],
                editor: new Ext.form.TextField({}),
                items: typesColumns,
                defaults: {
                    renderer: Ext.util.Format.htmlEncode
                },
        let data = record.data;
        let type = data.type;
        let property;
            property = {
                xtype: 'textfield',
                flex: 1,
                value: data.data
            }
            property = {
                xtype: "textarea",
                flex: 1,
                value: data.data
            }