CVE-2022-0285: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.2.9.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-01-20T15:15Z
Repository: https://github.com/pimcore/pimcore
Language: PHP
Files changed: bundles/AdminBundle/Controller/Admin/SettingsController.php, bundles/AdminBundle/Resources/public/js/pimcore/settings/thumbnail/item.js
Commit date: 2022-01-19 16:24:47 +0100
Commit message: [Thumbnails] Escape group text properly

Diff: diff --git a/bundles/AdminBundle/Controller/Admin/SettingsController.php b/bundles/AdminBundle/Controller/Admin/SettingsController.php
index 44f1ea3dbaf..e2df9de0487 100644
--- a/bundles/AdminBundle/Controller/Admin/SettingsController.php
+++ b/bundles/AdminBundle/Controller/Admin/SettingsController.php
@@ -1159,11 +1159,11 @@ class SettingsController extends AdminController
         foreach ($list->getThumbnails() as $item) {
             if ($item->getGroup()) {
                 if (empty($groups[$item->getGroup()])) {
                     $groups[$item->getGroup()] = [
                         'id' => 'group_' . $item->getName(),
-                        'text' => $item->getGroup(),
+                        'text' => htmlspecialchars($item->getGroup()),
                         'expandable' => true,
                         'leaf' => false,
                         'allowChildren' => true,
                         'iconCls' => 'pimcore_icon_folder',
                         'group' => $item->getGroup(),
@@ -1386,14 +1386,14 @@ class SettingsController extends AdminController
         $list = new Asset\Video\Thumbnail\Config\Listing();
 
         $groups = [];
         foreach ($list->getThumbnails() as $item) {
             if ($item->getGroup()) {
-                if (!$groups[$item->getGroup()]) {
+                if (empty($groups[$item->getGroup()])) {
                     $groups[$item->getGroup()] = [
                         'id' => 'group_' . $item->getName(),
-                        'text' => $item->getGroup(),
+                        'text' => htmlspecialchars($item->getGroup()),
                         'expandable' => true,
                         'leaf' => false,
                         'allowChildren' => true,
                         'iconCls' => 'pimcore_icon_folder',
                         'group' => $item->getGroup(),
diff --git a/bundles/AdminBundle/Resources/public/js/pimcore/settings/thumbnail/item.js b/bundles/AdminBundle/Resources/public/js/pimcore/settings/thumbnail/item.js
index a9f45c56ebd..979e2a52881 100644
--- a/bundles/AdminBundle/Resources/public/js/pimcore/settings/thumbnail/item.js
+++ b/bundles/AdminBundle/Resources/public/js/pimcore/settings/thumbnail/item.js
@@ -80,10 +80,11 @@ pimcore.settings.thumbnail.item = Class.create({
 
         this.groupField = new Ext.form.field.Text({
             name: "group",
             value: this.data.group,
             fieldLabel: t("group"),
+            renderer: Ext.util.Format.htmlEncode,
             width: 450
         });
 
         this.settings = new Ext.form.FormPanel({
             border: false,

Vulnerable code:                         'text' => $item->getGroup(),
                if (!$groups[$item->getGroup()]) {
                        'text' => $item->getGroup(),
Fixed code:                         'text' => htmlspecialchars($item->getGroup()),
                if (empty($groups[$item->getGroup()])) {
                        'text' => htmlspecialchars($item->getGroup()),
            renderer: Ext.util.Format.htmlEncode,