CVE-2021-4139 (JavaScript, published 2021-12-21T13:15Z)
Description: value: pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Severity: MEDIUM (CVSS v3 base score: 9)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/pimcore/pimcore
Files changed:
bundles/AdminBundle/Controller/Admin/DataObject/ClassificationstoreController.php
bundles/AdminBundle/Resources/public/js/pimcore/helpers/generic-grid.js
bundles/AdminBundle/Resources/public/js/pimcore/object/classificationstore/collectionsPanel.js
bundles/AdminBundle/Resources/public/js/pimcore/object/classificationstore/groupsPanel.js
bundles/AdminBundle/Resources/public/js/pimcore/object/classificationstore/propertiesPanel.js
bundles/AdminBundle/Resources/public/js/pimcore/object/classificationstore/storeTree.js
Commit message: [Classification Store] Properly escape values on grids & titles


Vulnerable code:
                'text' => $item->getName(),
                'description' => $item->getDescription(),
            $resultItem['qtip'] = $item->getDescription() ? $item->getDescription() : ' ';
    return t(value);
        gridColumns.push({text: t("name"), flex: 200, sortable: true, dataIndex: 'groupName', filter: 'string'});
        gridColumns.push({text: t("description"), flex: 200, sortable: true, dataIndex: 'groupDescription', filter: 'string'});
        gridColumns.push({text: t("name"), flex: 200, sortable: true, dataIndex: 'name', editor: new Ext.form.TextField({}), filter: 'string'});
        gridColumns.push({text: t("description"), flex: 300, sortable: true, dataIndex: 'description', editor: new Ext.form.TextField({}), filter: 'string'});
                        var collectionName = record.data.name;
        gridColumns.push({text: t("name"), flex: 200, sortable: true, dataIndex: 'keyName', filter: 'string'});
        gridColumns.push({text: t("description"), flex: 200, sortable: true, dataIndex: 'keyDescription', filter: 'string'});
        gridColumns.push({text: t("name"), flex: 200, sortable: true, dataIndex: 'name', editor: new Ext.form.TextField({}), filter: 'string'});
        gridColumns.push({text: t("description"), flex: 300, sortable: true, dataIndex: 'description', editor: new Ext.form.TextField({}), filter: 'string'});
                        var groupName = record.data.name;
                editor: new Ext.form.TextField({})
        gridColumns.push({text: t("title"), width: 200, sortable: false, dataIndex: 'title',editor: new Ext.form.TextField({}), filter: 'string'});
        gridColumns.push({text: t("description"), width: 300, sortable: true, dataIndex: 'description',editor: new Ext.form.TextField({}), filter: 'string'});
            definition.name = data.data.name;
                        name: record.data.text,
                        description: record.data.description

Fixed code:
                'text' => htmlspecialchars($item->getName(), ENT_QUOTES),
                'description' => htmlspecialchars($item->getDescription(), ENT_QUOTES),
            $resultItem['qtip'] = $item->getDescription() ? htmlspecialchars($item->getDescription(), ENT_QUOTES) : ' ';
    return Ext.util.Format.htmlEncode(t(value));
        gridColumns.push({text: t("name"), flex: 200, sortable: true, dataIndex: 'groupName', filter: 'string',
            renderer: Ext.util.Format.htmlEncode});
        gridColumns.push({text: t("description"), flex: 200, sortable: true, dataIndex: 'groupDescription', filter: 'string',
            renderer: Ext.util.Format.htmlEncode});
        gridColumns.push({text: t("name"), flex: 200, sortable: true, dataIndex: 'name', editor: new Ext.form.TextField({}), filter: 'string',
            renderer: Ext.util.Format.htmlEncode});
        gridColumns.push({text: t("description"), flex: 300, sortable: true, dataIndex: 'description', editor: new Ext.form.TextField({}), filter: 'string',
            renderer: Ext.util.Format.htmlEncode});
                        var collectionName = Ext.util.Format.htmlEncode(record.data.name);
        gridColumns.push({text: t("name"), flex: 200, sortable: true, dataIndex: 'keyName', filter: 'string',
            renderer: Ext.util.Format.htmlEncode});
        gridColumns.push({text: t("description"), flex: 200, sortable: true, dataIndex: 'keyDescription', filter: 'string',
            renderer: Ext.util.Format.htmlEncode});
        gridColumns.push({text: t("name"), flex: 200, sortable: true, dataIndex: 'name', editor: new Ext.form.TextField({}), filter: 'string',
            renderer: Ext.util.Format.htmlEncode});
        gridColumns.push({text: t("description"), flex: 300, sortable: true, dataIndex: 'description', editor: new Ext.form.TextField({}), filter: 'string',
            renderer: Ext.util.Format.htmlEncode});
                        var groupName = Ext.util.Format.htmlEncode(record.data.name);
                editor: new Ext.form.TextField({}),
                renderer: Ext.util.Format.htmlEncode
        gridColumns.push({text: t("title"), width: 200, sortable: false, dataIndex: 'title',editor: new Ext.form.TextField({}), filter: 'string',
            renderer: Ext.util.Format.htmlEncode});
        gridColumns.push({text: t("description"), width: 300, sortable: true, dataIndex: 'description',editor: new Ext.form.TextField({}), filter: 'string',
            renderer: Ext.util.Format.htmlEncode});
            definition.name = Ext.util.Format.htmlEncode(data.data.name);
                        name: Ext.util.Format.htmlDecode(record.data.text),
                        description: Ext.util.Format.htmlDecode(record.data.description)