CVE-2019-10909: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, validation messages are not escaped, which can lead to XSS when user input is included. This is related to symfony/framework-bundle.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2019-05-16T22:29Z
Repository: https://github.com/symfony/symfony
Language: PHP
Files changed: src/Symfony/Bundle/FrameworkBundle/Resources/views/Form/choice_widget_collapsed.html.php, src/Symfony/Bundle/FrameworkBundle/Resources/views/Form/form_errors.html.php, src/Symfony/Bundle/FrameworkBundle/Resources/views/Form/form_start.html.php
Commit date: 2019-04-06 11:38:26 +0200
Commit message: Fix XSS issues in the form theme of the PHP templating engine

Diff: diff --git a/src/Symfony/Bundle/FrameworkBundle/Resources/views/Form/choice_widget_collapsed.html.php b/src/Symfony/Bundle/FrameworkBundle/Resources/views/Form/choice_widget_collapsed.html.php
index c63d354e178..6a57d585c7b 100644
--- a/src/Symfony/Bundle/FrameworkBundle/Resources/views/Form/choice_widget_collapsed.html.php
+++ b/src/Symfony/Bundle/FrameworkBundle/Resources/views/Form/choice_widget_collapsed.html.php
@@ -9,10 +9,10 @@
 >
     <?php if (null !== $placeholder): ?><option value=""<?php if ($required && empty($value) && '0' !== $value): ?> selected="selected"<?php endif?>><?php echo '' != $placeholder ? $view->escape(false !== $translation_domain ? $view['translator']->trans($placeholder, [], $translation_domain) : $placeholder) : '' ?></option><?php endif; ?>
     <?php if (count($preferred_choices) > 0): ?>
         <?php echo $view['form']->block($form, 'choice_widget_options', ['choices' => $preferred_choices]) ?>
         <?php if (count($choices) > 0 && null !== $separator): ?>
-            <option disabled="disabled"><?php echo $separator ?></option>
+            <option disabled="disabled"><?php echo $view->escape($separator) ?></option>
         <?php endif ?>
     <?php endif ?>
     <?php echo $view['form']->block($form, 'choice_widget_options', ['choices' => $choices]) ?>
 </select>
diff --git a/src/Symfony/Bundle/FrameworkBundle/Resources/views/Form/form_errors.html.php b/src/Symfony/Bundle/FrameworkBundle/Resources/views/Form/form_errors.html.php
index 77c60d7dfb3..d97179e9a68 100644
--- a/src/Symfony/Bundle/FrameworkBundle/Resources/views/Form/form_errors.html.php
+++ b/src/Symfony/Bundle/FrameworkBundle/Resources/views/Form/form_errors.html.php
@@ -1,7 +1,7 @@
 <?php if (count($errors) > 0): ?>
     <ul>
         <?php foreach ($errors as $error): ?>
-            <li><?php echo $error->getMessage() ?></li>
+            <li><?php echo $view->escape($error->getMessage()) ?></li>
         <?php endforeach; ?>
     </ul>
 <?php endif ?>
diff --git a/src/Symfony/Bundle/FrameworkBundle/Resources/views/Form/form_start.html.php b/src/Symfony/Bundle/FrameworkBundle/Resources/views/Form/form_start.html.php
index ba2f3a47919..7e244258053 100644
--- a/src/Symfony/Bundle/FrameworkBundle/Resources/views/Form/form_start.html.php
+++ b/src/Symfony/Bundle/FrameworkBundle/Resources/views/Form/form_start.html.php
@@ -1,6 +1,6 @@
 <?php $method = strtoupper($method) ?>
 <?php $form_method = $method === 'GET' || $method === 'POST' ? $method : 'POST' ?>
-<form name="<?php echo $name ?>" method="<?php echo strtolower($form_method) ?>"<?php if ($action !== ''): ?> action="<?php echo $action ?>"<?php endif ?><?php foreach ($attr as $k => $v) { printf(' %s="%s"', $view->escape($k), $view->escape($v)); } ?><?php if ($multipart): ?> enctype="multipart/form-data"<?php endif ?>>
+<form name="<?php echo $name ?>" method="<?php echo strtolower($form_method) ?>"<?php if ($action !== ''): ?> action="<?php echo $view->escape($action) ?>"<?php endif ?><?php foreach ($attr as $k => $v) { printf(' %s="%s"', $view->escape($k), $view->escape($v)); } ?><?php if ($multipart): ?> enctype="multipart/form-data"<?php endif ?>>
 <?php if ($form_method !== $method): ?>
-    <input type="hidden" name="_method" value="<?php echo $method ?>" />
+    <input type="hidden" name="_method" value="<?php echo $view->escape($method) ?>" />
 <?php endif ?>

Vulnerable code:             <option disabled="disabled"><?php echo $separator ?></option>
            <li><?php echo $error->getMessage() ?></li>
<form name="<?php echo $name ?>" method="<?php echo strtolower($form_method) ?>"<?php if ($action !== ''): ?> action="<?php echo $action ?>"<?php endif ?><?php foreach ($attr as $k => $v) { printf(' %s="%s"', $view->escape($k), $view->escape($v)); } ?><?php if ($multipart): ?> enctype="multipart/form-data"<?php endif ?>>
    <input type="hidden" name="_method" value="<?php echo $method ?>" />
Fixed code:             <option disabled="disabled"><?php echo $view->escape($separator) ?></option>
            <li><?php echo $view->escape($error->getMessage()) ?></li>
<form name="<?php echo $name ?>" method="<?php echo strtolower($form_method) ?>"<?php if ($action !== ''): ?> action="<?php echo $view->escape($action) ?>"<?php endif ?><?php foreach ($attr as $k => $v) { printf(' %s="%s"', $view->escape($k), $view->escape($v)); } ?><?php if ($multipart): ?> enctype="multipart/form-data"<?php endif ?>>
    <input type="hidden" name="_method" value="<?php echo $view->escape($method) ?>" />