CVE-2022-0268: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in Packagist getgrav/grav prior to 1.7.28.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-01-25T11:15Z
Repository: https://github.com/getgrav/grav
Language: PHP
Files changed: CHANGELOG.md, composer.lock, system/src/Grav/Common/Security.php
Commit date: 2022-01-18 12:34:52 +0200
Commit message: Fixed XSS check not detecting escaped `&#58`

Diff: diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2f6ef24d5e..9ed78b296c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,10 +5,12 @@
     * Added links and modules support to `HtmlBlock` class
     * Added module support for twig script tag: `{% script module 'theme://js/module.mjs' %}`
     * Added twig tag for links: `{% link icon 'theme://images/favicon.png' priority: 20 with { type: 'image/png' } %}`
     * Added `HtmlBlock` support for `{% style %}`, `{% script %}` and `{% link %}` tags
     * Support for page-level `redirect_default_route` frontmatter header override
+3. [](#bugfix)
+    * Fixed XSS check not detecting escaped `&#58`
 
 # v1.7.27.1
 ## 01/12/2022
 
 3. [](#bugfix)
diff --git a/composer.lock b/composer.lock
index a3dbeb4764..1ac8be0b7d 100644
--- a/composer.lock
+++ b/composer.lock
@@ -4639,20 +4639,20 @@
             },
             "time": "2021-12-08T12:19:24+00:00"
         },
         {
             "name": "phpstan/phpstan",
-            "version": "1.4.0",
+            "version": "1.4.1",
             "source": {
                 "type": "git",
                 "url": "https://github.com/phpstan/phpstan.git",
-                "reference": "72b04d97b5e6e60a081f17c416fef35bd521120b"
+                "reference": "5bd02c86beb4c024dd4662b6443f5d5332a0ae12"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/phpstan/phpstan/zipball/72b04d97b5e6e60a081f17c416fef35bd521120b",
-                "reference": "72b04d97b5e6e60a081f17c416fef35bd521120b",
+                "url": "https://api.github.com/repos/phpstan/phpstan/zipball/5bd02c86beb4c024dd4662b6443f5d5332a0ae12",
+                "reference": "5bd02c86beb4c024dd4662b6443f5d5332a0ae12",
                 "shasum": ""
             },
             "require": {
                 "php": "^7.1|^8.0"
             },
@@ -4679,11 +4679,11 @@
                 "MIT"
             ],
             "description": "PHPStan - PHP Static Analysis Tool",
             "support": {
                 "issues": "https://github.com/phpstan/phpstan/issues",
-                "source": "https://github.com/phpstan/phpstan/tree/1.4.0"
+                "source": "https://github.com/phpstan/phpstan/tree/1.4.1"
             },
             "funding": [
                 {
                     "url": "https://github.com/ondrejmirtes",
                     "type": "github"
@@ -4699,11 +4699,11 @@
                 {
                     "url": "https://tidelift.com/funding/github/packagist/phpstan/phpstan",
                     "type": "tidelift"
                 }
             ],
-            "time": "2022-01-14T15:58:47+00:00"
+            "time": "2022-01-17T16:35:17+00:00"
         },
         {
             "name": "phpstan/phpstan-deprecation-rules",
             "version": "1.0.0",
             "source": {
diff --git a/system/src/Grav/Common/Security.php b/system/src/Grav/Common/Security.php
index a3ca3bb626..2d67bda5a7 100644
--- a/system/src/Grav/Common/Security.php
+++ b/system/src/Grav/Common/Security.php
@@ -212,11 +212,11 @@ class Security
         $patterns = [
             // Match any attribute starting with "on" or xmlns
             'on_events' => '#(<[^>]+[[a-z\x00-\x20\"\'\/])([\s\/]on|\sxmlns)[a-z].*=>?#iUu',
 
             // Match javascript:, livescript:, vbscript:, mocha:, feed: and data: protocols
-            'invalid_protocols' => '#(' . implode('|', array_map('preg_quote', $invalid_protocols, ['#'])) . '):\S.*?#iUu',
+            'invalid_protocols' => '#(' . implode('|', array_map('preg_quote', $invalid_protocols, ['#'])) . ')(:|\&\#58)\S.*?#iUu',
 
             // Match -moz-bindings
             'moz_binding' => '#-moz-binding[a-z\x00-\x20]*:#u',
 
             // Match style attributes

Vulnerable code:             "version": "1.4.0",
                "reference": "72b04d97b5e6e60a081f17c416fef35bd521120b"
                "url": "https://api.github.com/repos/phpstan/phpstan/zipball/72b04d97b5e6e60a081f17c416fef35bd521120b",
                "reference": "72b04d97b5e6e60a081f17c416fef35bd521120b",
                "source": "https://github.com/phpstan/phpstan/tree/1.4.0"
            "time": "2022-01-14T15:58:47+00:00"
            'invalid_protocols' => '#(' . implode('|', array_map('preg_quote', $invalid_protocols, ['#'])) . '):\S.*?#iUu',
Fixed code: 3. [](#bugfix)
    * Fixed XSS check not detecting escaped `&#58`
            "version": "1.4.1",
                "reference": "5bd02c86beb4c024dd4662b6443f5d5332a0ae12"
                "url": "https://api.github.com/repos/phpstan/phpstan/zipball/5bd02c86beb4c024dd4662b6443f5d5332a0ae12",
                "reference": "5bd02c86beb4c024dd4662b6443f5d5332a0ae12",
                "source": "https://github.com/phpstan/phpstan/tree/1.4.1"
            "time": "2022-01-17T16:35:17+00:00"
            'invalid_protocols' => '#(' . implode('|', array_map('preg_quote', $invalid_protocols, ['#'])) . ')(:|\&\#58)\S.*?#iUu',