CVE-2023-1703: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.20.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-03-29T16:15Z
Repository: https://github.com/pimcore/pimcore
Language: PHP
Files changed: bundles/AdminBundle/Controller/Admin/DataObject/ClassController.php, bundles/AdminBundle/Resources/public/js/pimcore/object/classes/class.js
Commit date: 2023-03-21 16:12:33 +0100
Commit message: [Task] Optimized composite index key (#14636)

* chore: validate composite index key

* fix: add php validation
Diff: diff --git a/bundles/AdminBundle/Controller/Admin/DataObject/ClassController.php b/bundles/AdminBundle/Controller/Admin/DataObject/ClassController.php
index ce44ed65340e..58959ce1cba2 100644
--- a/bundles/AdminBundle/Controller/Admin/DataObject/ClassController.php
+++ b/bundles/AdminBundle/Controller/Admin/DataObject/ClassController.php
@@ -453,10 +453,18 @@ class ClassController extends AdminController implements KernelControllerEventIn
 
             $values['name'] = $this->correctClassname($values['name']);
             $class->rename($values['name']);
         }
 
+        if ($values['compositeIndices']) {
+            foreach ($values['compositeIndices'] as $index => $compositeIndex) {
+                if ($compositeIndex['index_key'] !== ($sanitizedKey = preg_replace('/[^a-za-z0-9_\-+]/', '', $compositeIndex['index_key']))) {
+                    $values['compositeIndices'][$index]['index_key'] = $sanitizedKey;
+                }
+            }
+        }
+
         unset($values['creationDate']);
         unset($values['userOwner']);
         unset($values['layoutDefinitions']);
         unset($values['fieldDefinitions']);
 
diff --git a/bundles/AdminBundle/Resources/public/js/pimcore/object/classes/class.js b/bundles/AdminBundle/Resources/public/js/pimcore/object/classes/class.js
index 28602a94fdae..ebedbe757d2e 100644
--- a/bundles/AdminBundle/Resources/public/js/pimcore/object/classes/class.js
+++ b/bundles/AdminBundle/Resources/public/js/pimcore/object/classes/class.js
@@ -1083,11 +1083,18 @@ pimcore.object.classes.klass = Class.create({
             xtype: 'textfield',
             name: "index_key",
             fieldLabel: t("key"),
             labelWidth: 100,
             width: 250,
-            value: data.index_key
+            value: data.index_key,
+            validator: function (value) {
+                if(value !== value.replace(/[^a-za-z0-9_\-+]/g,'')){
+                    this.setvalue(value.replace(/[^a-za-z0-9_\-+]/g,''));
+                }
+
+                return true;
+            }
         };
 
         //fixes data to match store model
         const indexesArray = [];
         if(data.index_columns){

Vulnerable code:             value: data.index_key
Fixed code:         if ($values['compositeIndices']) {
            foreach ($values['compositeIndices'] as $index => $compositeIndex) {
                if ($compositeIndex['index_key'] !== ($sanitizedKey = preg_replace('/[^a-za-z0-9_\-+]/', '', $compositeIndex['index_key']))) {
                    $values['compositeIndices'][$index]['index_key'] = $sanitizedKey;
                }
            }
        }

            value: data.index_key,
            validator: function (value) {
                if(value !== value.replace(/[^a-za-z0-9_\-+]/g,'')){
                    this.setvalue(value.replace(/[^a-za-z0-9_\-+]/g,''));
                }

                return true;
            }