CVE-2023-2361 (PHP, published 2023-04-28T08:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/pimcore/pimcore
Files changed:
doc/Development_Documentation/03_Documents/01_Editables/18_Link.md
doc/Development_Documentation/23_Installation_and_Upgrade/09_Upgrade_Notes/README.md
lib/Security/SecurityHelper.php
models/Document/Editable/Link.php
Commit message: [Security] Fix xss in link editable (#14986)

* fixed xss in link editable

* added `sanitizeHtmlAttributes` to some other fields

* sanitized some more fields

* added update notes

* Update 18_Link.md

---------

Co-authored-by: robertSt7 <robert.steinkellner@pimcore.com>

Vulnerable code:
You can pass every valid attribute an `<a>`-tag can have ([w3.org - Link](https://www.w3.org/TR/html52/textlevel-semantics.html#the-a-element)), 
                'xml:lang',
                'onblur',
                'onclick',
                'ondblclick',
                'onfocus',
                'onmousedown',
                'onmousemove',
                'onmouseout',
                'onmouseover',
                'onmouseup',
                'onkeydown',
                'onkeypress',
                'onkeyup',
                        $attribs[] = $key.'="'. $this->data[$key] .' '. $this->config[$key] .'"';
                        $attribs[] = $key.'="'.$value.'"';
            $anchor = $this->getAnchor();
            $anchor = str_replace('"', urlencode('"'), $anchor);
        return $this->data['parameters'] ?? '';
        return $this->data['anchor'] ?? '';
        return $this->data['rel'] ?? '';
        return $this->data['tabindex'] ?? '';
        return $this->data['accesskey'] ?? '';
        return $this->data['class'] ?? '';

Fixed code:
You can pass nearly every valid attribute an `<a>`-tag can have ([w3.org - Link](https://www.w3.org/TR/html52/textlevel-semantics.html#the-a-element)), 
> For security reasons we created an [allow list](https://github.com/pimcore/pimcore/blob/9bf18aca55e5303661c68835c950412a428cf616/models/Document/Editable/Link.php#L115-L141) to filter harmfull html attributes. For example all `on*` attributes will be filtered out!

- [Editable] Removed all `on*` attributes from the `$allowedAttributes` list due to security reasons. These attributes are not allowed anymore in the "attributes" field.

    public static function sanitizeHtmlAttributes(?string $text): ?string
    {
        if(is_string($text)) {
            return preg_replace('/[\/"\'\\\]/', '', $text);
        }

        return null;
    }
use Pimcore\Security\SecurityHelper;
                'xml:lang'
                        $attribs[] = $key.'="'. SecurityHelper::sanitizeHtmlAttributes($this->data[$key]) .' '. SecurityHelper::sanitizeHtmlAttributes($this->config[$key]) .'"';
                        $attribs[] = $key.'="'.SecurityHelper::sanitizeHtmlAttributes($value).'"';
            $anchor = str_replace('"', urlencode('"'), $this->getAnchor());
        if($editmode) {
            unset($this->data['attributes']);
        }

        return SecurityHelper::sanitizeHtmlAttributes($this->data['parameters']) ?? '';
        return SecurityHelper::sanitizeHtmlAttributes($this->data['anchor']) ?? '';
        return SecurityHelper::sanitizeHtmlAttributes($this->data['rel']) ?? '';
        return SecurityHelper::sanitizeHtmlAttributes($this->data['tabindex']) ?? '';
        return SecurityHelper::sanitizeHtmlAttributes($this->data['accesskey']) ?? '';
        return SecurityHelper::sanitizeHtmlAttributes($this->data['class']) ?? '';
        //sanitize fields
        $fieldsToExclude = ['path'];
        foreach($this->data as $key => $value) {
            if(!in_array($key, $fieldsToExclude)) {
                $this->data[$key] = SecurityHelper::sanitizeHtmlAttributes($value);
            }
        }