CVE-2023-2616 (PHP, published 2023-05-10T05:15Z)
Description: value: Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.21.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/pimcore/pimcore
Files changed:
bundles/AdminBundle/Controller/Admin/DataObject/ClassificationstoreController.php
bundles/AdminBundle/Resources/public/js/pimcore/helpers.js
bundles/AdminBundle/Resources/public/js/pimcore/settings/staticroutes.js
lib/Security/SecurityHelper.php
models/Staticroute.php
Commit message: [Security] Fix xss in static routes panel (#14947)

* added new helper function to htmlEncode textFields, fixed xss issue in static routes panel

* added `htmlspecialchars` to model

* fixed double encode issue

* fixed double encode problem in BE

* changed type of `htmlspecialchars`, added `htmlspecialchars` to `setMethods`

* improved `htmlSpecialChars`

* changed SecurityHelper method name to `convertHtmlSpecialChars`

* added htmlEncode to `deleteConfirm` msgbox

Vulnerable code:
        $name = SecurityHelper::getStringWithoutControlChars($request->get('name'));
        $name = SecurityHelper::getStringWithoutControlChars($request->get('name'));
        $name = SecurityHelper::getStringWithoutControlChars($request->get('name'));
                editor:new Ext.form.TextField({})},
                editor:new Ext.form.TextField({})},
                editor:new Ext.form.TextField({})},
                editor:new Ext.form.TextField({})},
                editor:new Ext.form.TextField({})},
                editor:new Ext.form.TextField({}),
                editor:new Ext.form.TextField({}),
                        pimcore.helpers.deleteConfirm(t('staticroute'), data.data.name, function () {
                            grid.getStore().removeAt(rowIndex);
                        }.bind(this));
    public static function getStringWithoutControlChars(string $text): string
        return preg_replace('[\\\\<>"\'`!?/%$(){};,:|=]', '', $text);
        $this->pattern = $pattern;
        $this->controller = $controller;
        $this->variables = $variables;
        $this->defaults = $defaults;
        $this->name = $name;
        $this->reverse = $reverse;
            $methods = array_map('trim', $methods);

Fixed code:
        $name = SecurityHelper::convertHtmlSpecialChars($request->get('name'));
        $name = SecurityHelper::convertHtmlSpecialChars($request->get('name'));
        $name = SecurityHelper::convertHtmlSpecialChars($request->get('name'));
pimcore.helpers.htmlEncodeTextField = function (textField) {
    if(textField.getValue()) {
        textField.suspendEvent('change');
        const decodedValue = Ext.util.Format.htmlDecode(textField.getValue());
        textField.setValue(
            Ext.util.Format.htmlEncode(decodedValue)
        );
        textField.resumeEvent('change');
    }
};

                editor:new Ext.form.TextField({listeners: {'change': pimcore.helpers.htmlEncodeTextField}})},
                editor:new Ext.form.TextField({listeners: {'change': pimcore.helpers.htmlEncodeTextField}})},
                editor:new Ext.form.TextField({listeners: {'change': pimcore.helpers.htmlEncodeTextField}})},
                    },
                    listeners: {
                        'change': pimcore.helpers.htmlEncodeTextField
                editor:new Ext.form.TextField({listeners: {'change': pimcore.helpers.htmlEncodeTextField}})},
                editor:new Ext.form.TextField({listeners: {'change': pimcore.helpers.htmlEncodeTextField}})},
                editor:new Ext.form.TextField({listeners: {'change': pimcore.helpers.htmlEncodeTextField}}),
                editor:new Ext.form.TextField({listeners: {'change': pimcore.helpers.htmlEncodeTextField}}),
                        const decodedName = Ext.util.Format.htmlDecode(data.data.name);

                        pimcore.helpers.deleteConfirm(
                            t('staticroute'),
                            Ext.util.Format.htmlEncode(decodedName),
                            function () {
                                grid.getStore().removeAt(rowIndex);
                            }.bind(this)
                        );
    public static function convertHtmlSpecialChars(?string $text): ?string
        if(is_string($text)){
            return htmlspecialchars($text, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8', false);
        }

        return null;
use Pimcore\Security\SecurityHelper;
        $this->pattern = SecurityHelper::convertHtmlSpecialChars($pattern);
        $this->controller = SecurityHelper::convertHtmlSpecialChars($controller);
        $this->variables = SecurityHelper::convertHtmlSpecialChars($variables);
        $this->defaults = SecurityHelper::convertHtmlSpecialChars($defaults);
        $this->name = SecurityHelper::convertHtmlSpecialChars($name);
        $this->reverse = SecurityHelper::convertHtmlSpecialChars($reverse);
            foreach($methods as $key => $method) {
                $methods[$key] = SecurityHelper::convertHtmlSpecialChars(trim($method));
            }