CVE-2023-1067: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.18.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-02-27T14:15Z
Repository: https://github.com/pimcore/pimcore
Language: JavaScript
Files changed: bundles/AdminBundle/Resources/public/js/pimcore/settings/gdpr/dataproviders/sentMail.js, bundles/AdminBundle/Resources/public/js/pimcore/settings/gdpr/gdprPanel.js
Commit date: 2023-02-27 13:14:42 +0100
Commit message: [Task] Improve GDPR email search (#14410)

* improved email in toolbar

* added validator to email search input
Diff: diff --git a/bundles/AdminBundle/Resources/public/js/pimcore/settings/gdpr/dataproviders/sentMail.js b/bundles/AdminBundle/Resources/public/js/pimcore/settings/gdpr/dataproviders/sentMail.js
index ea4539499f84..62afb48f02e0 100644
--- a/bundles/AdminBundle/Resources/public/js/pimcore/settings/gdpr/dataproviders/sentMail.js
+++ b/bundles/AdminBundle/Resources/public/js/pimcore/settings/gdpr/dataproviders/sentMail.js
@@ -364,11 +364,11 @@ pimcore.settings.gdpr.dataproviders.sentMail = Class.create({
 
         var toolbar = Ext.create('Ext.Toolbar', {
             cls: 'pimcore_main_toolbar',
             items: [
                 {
-                    text: t("gdpr_dataSource_sentMail_only_email") + ": " + this.searchParams.email,
+                    text: t("gdpr_dataSource_sentMail_only_email") + ": " + Ext.util.Format.htmlEncode(this.searchParams.email),
                     xtype: "tbtext",
                     style: "margin: 0 10px 0 0;"
                 }
             ]
         });
diff --git a/bundles/AdminBundle/Resources/public/js/pimcore/settings/gdpr/gdprPanel.js b/bundles/AdminBundle/Resources/public/js/pimcore/settings/gdpr/gdprPanel.js
index 58f1814415aa..fbfecaa1c04c 100644
--- a/bundles/AdminBundle/Resources/public/js/pimcore/settings/gdpr/gdprPanel.js
+++ b/bundles/AdminBundle/Resources/public/js/pimcore/settings/gdpr/gdprPanel.js
@@ -74,11 +74,18 @@ pimcore.settings.gdpr.gdprPanel = Class.create({
                     items: [
                         {
                             xtype: 'textfield',
                             name: 'email',
                             fieldLabel: t("gdpr_data_extractor_label_email"),
-                            width: 650
+                            width: 650,
+                            validator: function (value) {
+                                if(value !== value.replace(/[^a-zA-Z0-9_\-@.]/g,'')){
+                                    this.setValue(value.replace(/[^a-zA-Z0-9_\-@.]/g,''));
+                                }
+
+                                return true;
+                            }
                         },
                         {
                             xtype: "button",
                             text: t("search"),
                             iconCls: "pimcore_icon_search",

Vulnerable code:                     text: t("gdpr_dataSource_sentMail_only_email") + ": " + this.searchParams.email,
                            width: 650
Fixed code:                     text: t("gdpr_dataSource_sentMail_only_email") + ": " + Ext.util.Format.htmlEncode(this.searchParams.email),
                            width: 650,
                            validator: function (value) {
                                if(value !== value.replace(/[^a-zA-Z0-9_\-@.]/g,'')){
                                    this.setValue(value.replace(/[^a-zA-Z0-9_\-@.]/g,''));
                                }

                                return true;
                            }