CVE-2023-2343 (JavaScript, published 2023-04-27T14:15Z)
Description: value: Cross-site Scripting (XSS) - DOM in GitHub repository pimcore/pimcore prior to 10.5.21.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/pimcore/pimcore
Files changed:
bundles/AdminBundle/Controller/Admin/DataObject/ClassificationstoreController.php
bundles/AdminBundle/Resources/public/js/pimcore/helpers.js
bundles/AdminBundle/Resources/public/js/pimcore/object/classificationstore/collectionsPanel.js
bundles/AdminBundle/Resources/public/js/pimcore/object/classificationstore/groupsPanel.js
bundles/AdminBundle/Resources/public/js/pimcore/object/classificationstore/propertiesPanel.js
lib/Security/SecurityHelper.php
Commit message: [Security] XSS in Classification Store of Data Objects module (#14933)

* Fix: xss in CS

* Fix: implement feedback

Vulnerable code:
        $name = $request->get('name');
        $name = $request->get('name');
        $name = $request->get('name');
                        Ext.Msg.confirm(t('delete'), sprintf(t('delete_message_advanced'), t('classificationstore_collection_relation'), data.data.groupName), function(btn) {
                        Ext.Msg.confirm(t('delete'), sprintf(t('delete_message_advanced'), t('classificationstore_collection'), data.data.name), function(btn) {

        value = value.trim();
                        Ext.Msg.confirm(t('delete'), sprintf(t('delete_message_advanced'), t('classificationstore_relation'), data.data.keyName), function(btn) {
                        Ext.Msg.confirm(t('delete'), sprintf(t('delete_message_advanced'), t('classificationstore_group'), data.data.name), function(btn) {

        value = value.trim();
                        Ext.Msg.confirm(t('delete'), sprintf(t('delete_message_advanced'), t('classificationstore_property'), data.data.name), function(btn) {

        value = value.trim();

Fixed code:
use Pimcore\Security\SecurityHelper;
        $name = SecurityHelper::getStringWithoutControlChars($request->get('name'));
        $name = SecurityHelper::getStringWithoutControlChars($request->get('name'));
        $name = SecurityHelper::getStringWithoutControlChars($request->get('name'));

pimcore.helpers.getStringWithoutControlChars = function (text) {
    return text.replace(/[<>"'`!?/\\%$(){};,:|=]/gi, '');
};
                        Ext.Msg.confirm(t('delete'), sprintf(t('delete_message_advanced'), t('classificationstore_collection_relation'), pimcore.helpers.getStringWithoutControlChars(data.data.groupName)), function(btn) {
                        Ext.Msg.confirm(t('delete'), sprintf(t('delete_message_advanced'), t('classificationstore_collection'), pimcore.helpers.getStringWithoutControlChars(data.data.name)), function(btn) {
        value = pimcore.helpers.getStringWithoutControlChars(value).trim();
                        Ext.Msg.confirm(t('delete'), sprintf(t('delete_message_advanced'), t('classificationstore_relation'), pimcore.helpers.getStringWithoutControlChars(data.data.keyName)), function(btn) {
                        Ext.Msg.confirm(t('delete'), sprintf(t('delete_message_advanced'), t('classificationstore_group'), pimcore.helpers.getStringWithoutControlChars(data.data.name)), function(btn) {
        value = pimcore.helpers.getStringWithoutControlChars(value).trim();
                        Ext.Msg.confirm(t('delete'), sprintf(t('delete_message_advanced'), t('classificationstore_property'), pimcore.helpers.getStringWithoutControlChars(data.data.name)), function(btn) {
        value = pimcore.helpers.getStringWithoutControlChars(value).trim();
<?php

/**
 * Pimcore
 *
 * This source file is available under two different licenses:
 * - GNU General Public License version 3 (GPLv3)
 * - Pimcore Commercial License (PCL)
 * Full copyright and license information is available in
 * LICENSE.md which is distributed with this source code.
 *
 *  @copyright  Copyright (c) Pimcore GmbH (http://www.pimcore.org)
 *  @license    http://www.pimcore.org/license     GPLv3 and PCL
 */

namespace Pimcore\Security;

class SecurityHelper
{
    public static function getStringWithoutControlChars(string $text): string
    {
        return preg_replace('[\\\\<>"\'`!?/%$(){};,:|=]','', $text);
    }
}