CVE-2023-33195: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Craft is a CMS for creating custom digital experiences on the web. A malformed RSS feed can deliver an XSS payload. This issue was patched in version 4.4.6.



CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-05-27T04:15Z
Repository: https://github.com/craftcms/cms
Language: Other
Files changed: CHANGELOG.md, src/templates/_components/widgets/CraftSupport/body.twig, src/templates/_includes/links.twig
Commit date: 2023-04-03 16:44:01 -0700
Commit message: Fixed an XSS vulnerability

Diff: diff --git a/CHANGELOG.md b/CHANGELOG.md
index f1ef916512f..3cf66ff96d5 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -16,11 +16,11 @@
 - Fixed a bug where the wrong tab would appear to be initially selected after an autosave, if the selected tab had changed during the autosave. ([#12960](https://github.com/craftcms/cms/issues/12960))
 - Fixed a bug where it wasn’t possible to add a Dropdown field without a blank option to a global set. ([#12965](https://github.com/craftcms/cms/issues/12965))
 - Fixed a bug where automatically-added Matrix blocks (per the field’s Min Blocks setting) were getting discarded if no changes were made to them. ([#12973](https://github.com/craftcms/cms/issues/12973))
 - Fixed an error that could occur when installing Craft with an existing project config, if any image transforms were defined that didn’t specify the `upscale` property.
 - Fixed a bug where nested folders in asset search results weren’t showing their relative path.
-- Fixed an XSS vulnerability.
+- Fixed XSS vulnerabilities.
 
 ## 4.4.5 - 2023-03-21
 
 - Fixed a bug where relation data was getting deleted when running garbage collection on PostgreSQL. ([#9905](https://github.com/craftcms/cms/issues/9905))
 - Fixed a bug where Lightswitch fields’ “OFF Label” and “ON Label” settings weren’t getting translated. ([#12942](https://github.com/craftcms/cms/issues/12942))
diff --git a/src/templates/_components/widgets/CraftSupport/body.twig b/src/templates/_components/widgets/CraftSupport/body.twig
index 24ef8649d86..1b7bd0d51b2 100644
--- a/src/templates/_components/widgets/CraftSupport/body.twig
+++ b/src/templates/_components/widgets/CraftSupport/body.twig
@@ -76,15 +76,15 @@
                         {{ svg('@appicons/magnifying-glass.svg', namespace=true)|attr({ 'aria-hidden': 'true' }) }}
                         <span>{{ 'Knowledge Base'|t('app') }}</span>
                     {% endset %}
                     {{ links.externalLink({
                         link: 'https://craftcms.com/docs/4.x/',
-                        text: documentationLinkHtml
+                        html: documentationLinkHtml
                     }) }}
                     {{ links.externalLink({
                         link: 'https://craftcms.com/knowledge-base',
-                        text: knowledgeBaseLinkHtml
+                        html: knowledgeBaseLinkHtml
                     }) }}
                 </div>
             </form>
             <form class="cs-support-form hidden" action="{{ actionUrl('dashboard/send-support-request') }}" method="post" target="{{ idPrefix }}-iframe" accept-charset="UTF-8" enctype="multipart/form-data">
                 {{ csrfInput() }}
diff --git a/src/templates/_includes/links.twig b/src/templates/_includes/links.twig
index 0880e7c007b..90007f7f9db 100644
--- a/src/templates/_includes/links.twig
+++ b/src/templates/_includes/links.twig
@@ -9,9 +9,9 @@
 {% macro externalLink(config) %}
     {% set linkAttributes = {
         href: config.link,
         target: '_blank',
         rel: 'noopener',
-        html: config.text ~ _self.externalLinkIcon()
+        html: (config.html ?? config.text|e) ~ _self.externalLinkIcon()
     } %}
     {{ tag('a', linkAttributes) }}
-{% endmacro %}
\ No newline at end of file
+{% endmacro %}

Vulnerable code: - Fixed an XSS vulnerability.
                        text: documentationLinkHtml
                        text: knowledgeBaseLinkHtml
        html: config.text ~ _self.externalLinkIcon()
{% endmacro %}
Fixed code: - Fixed XSS vulnerabilities.
                        html: documentationLinkHtml
                        html: knowledgeBaseLinkHtml
        html: (config.html ?? config.text|e) ~ _self.externalLinkIcon()
{% endmacro %}