CVE-2022-3211: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.6.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-09-15T14:15Z
Repository: https://github.com/pimcore/pimcore
Language: JavaScript
Files changed: bundles/AdminBundle/Resources/public/js/pimcore/element/properties.js, bundles/AdminBundle/Resources/public/js/pimcore/notification/helper.js, bundles/AdminBundle/Resources/public/js/pimcore/notification/panel.js
Commit date: 2022-09-13 14:00:58 +0200
Commit message: [Admin] escape values on UI (#13129)

* [Admin] Escape values on UI - Properties

* [Admin] Escape values on UI - Notifications

* [Admin] Escape values on UI - Notifications
Diff: diff --git a/bundles/AdminBundle/Resources/public/js/pimcore/element/properties.js b/bundles/AdminBundle/Resources/public/js/pimcore/element/properties.js
index fc06ee0d4327..461a0f13e6bd 100644
--- a/bundles/AdminBundle/Resources/public/js/pimcore/element/properties.js
+++ b/bundles/AdminBundle/Resources/public/js/pimcore/element/properties.js
@@ -437,11 +437,11 @@ pimcore.element.properties = Class.create({
         return this.layout;
     },
 
     getTypeRenderer: function (value, metaData, record, rowIndex, colIndex, store) {
 
-        return '<div class="pimcore_icon_' + value + '" name="' + record.data.name + '">&nbsp;</div>';
+        return '<div class="pimcore_icon_' + value + '" name="' + Ext.util.Format.htmlEncode(record.data.name) + '">&nbsp;</div>';
     },
 
     getCellRenderer: function (value, metaData, record, rowIndex, colIndex, store) {
 
         var data = store.getAt(rowIndex).data;
diff --git a/bundles/AdminBundle/Resources/public/js/pimcore/notification/helper.js b/bundles/AdminBundle/Resources/public/js/pimcore/notification/helper.js
index dc2654f8ddc9..ed62175193bf 100644
--- a/bundles/AdminBundle/Resources/public/js/pimcore/notification/helper.js
+++ b/bundles/AdminBundle/Resources/public/js/pimcore/notification/helper.js
@@ -74,12 +74,12 @@ pimcore.notification.helper.showNotifications = function (notifications) {
                 }
             }(row))
         });
         var notification = Ext.create('Ext.window.Toast', {
             iconCls: 'pimcore_icon_' + row.type,
-            title: row.title,
-            html: row.message,
+            title: Ext.util.Format.htmlEncode(row.title),
+            html: Ext.util.Format.htmlEncode(row.message),
             autoShow: true,
             width: 400,
             height: 150,
             closable: true,
             autoClose: false,
@@ -134,12 +134,12 @@ pimcore.notification.helper.openDetails = function (id, callback) {
 
 pimcore.notification.helper.openDetailsWindow = function (id, title, message, type, callback) {
     var notification = new Ext.Window({
         modal: true,
         iconCls: 'pimcore_icon_' + type,
-        title: title,
-        html: message,
+        title: Ext.util.Format.htmlEncode(title),
+        html: Ext.util.Format.htmlEncode(message),
         autoShow: true,
         width: 700,
         height: 350,
         scrollable: true,
         closable: true,
diff --git a/bundles/AdminBundle/Resources/public/js/pimcore/notification/panel.js b/bundles/AdminBundle/Resources/public/js/pimcore/notification/panel.js
index c771ae78a780..2e1e87610c3d 100644
--- a/bundles/AdminBundle/Resources/public/js/pimcore/notification/panel.js
+++ b/bundles/AdminBundle/Resources/public/js/pimcore/notification/panel.js
@@ -77,17 +77,18 @@ pimcore.notification.panel = Class.create({
                 sortable: true,
                 filter: 'string',
                 dataIndex: 'title',
                 renderer: function (val, metaData, record, rowIndex, colIndex, store) {
                     var read = parseInt(store.getAt(rowIndex).get("read"));
+                    val = Ext.util.Format.htmlEncode(val);
                     if (read == 0) {
                         return '<strong style="font-weight: bold;">' + val + '</strong>'; // css style need to be added
                     }
                     return val;
                 }
             },
-            {header: t("sender"), flex: 2, sortable: false, dataIndex: 'sender'},
+            {header: t("sender"), flex: 2, sortable: false, dataIndex: 'sender', renderer: Ext.util.Format.htmlEncode},
             {header: t("date"), flex: 3, sortable: true, filter: 'date', dataIndex: 'date'},
             {
                 header: t("attachment"),
                 xtype: 'actioncolumn',
                 flex: 1,

Vulnerable code:         return '<div class="pimcore_icon_' + value + '" name="' + record.data.name + '">&nbsp;</div>';
            title: row.title,
            html: row.message,
        title: title,
        html: message,
            {header: t("sender"), flex: 2, sortable: false, dataIndex: 'sender'},
Fixed code:         return '<div class="pimcore_icon_' + value + '" name="' + Ext.util.Format.htmlEncode(record.data.name) + '">&nbsp;</div>';
            title: Ext.util.Format.htmlEncode(row.title),
            html: Ext.util.Format.htmlEncode(row.message),
        title: Ext.util.Format.htmlEncode(title),
        html: Ext.util.Format.htmlEncode(message),
                    val = Ext.util.Format.htmlEncode(val);
            {header: t("sender"), flex: 2, sortable: false, dataIndex: 'sender', renderer: Ext.util.Format.htmlEncode},