Vulnerability: Potential XSS injection In PrestaShop contactform ### Impact
An attacker is able to inject javascript while using the contact form. 

### Patches
The problem is fixed in v4.3.0

### References
[Cross-site Scripting (XSS) - Stored (CWE-79)](https://cwe.mitre.org/data/definitions/79.html)
Vulnerability ID: GHSA-95hx-62rh-gg96
CWE: CWE-79
Severity score: 8
Project: https://github.com/PrestaShop/contactform
Published: 2020-09-15
File: contactform.php
Commit message: Merge pull request from GHSA-95hx-62rh-gg96

Do not unescape form message data
Commit author: GoT

Vulnerable version (before fix):
 public function getWidgetVariables($hookName = null, array $configuration = [])             }         }         $this->contact['contacts'] = $this->getTemplateVarContact();         $this->contact['message'] = html_entity_decode(Tools::getValue('message'));         $this->contact['allow_file_upload'] = (bool) Configuration::get('PS_CUSTOMER_SERVICE_FILE_UPLOAD');          if (!(bool)Configuration::isCatalogMode()) { public function getTemplateVarOrders()     {         $orders = [];          if (!isset($this->customer_thread['id_order'])             && isset($this->context->customer)             && $this->context->customer->isLogged()) {             $customer_orders = Order::getCustomerOrders($this->context->customer->id);              foreach ($customer_orders as $customer_order) { public function getTemplateVarOrders()                     $orders[$customer_order['id_order']]['products'] = $myOrder->getProducts();                 }             }         } elseif (isset($this->customer_thread['id_order']) && (int)$this->customer_thread['id_order'] > 0) {             $myOrder = new Order($this->customer_thread['id_order']);              if (Validate::isLoadedObject($myOrder)) { public function getTemplateVarOrders()             }         }          if (isset($this->customer_thread['id_product'])) {             $id_order = isset($this->customer_thread['id_order']) ?                       (int)$this->customer_thread['id_order'] :                       0;              $orders[$id_order]['products'][(int)$this->customer_thread['id_product']] = $this->context->controller->objectPresenter->present(                 new Product((int)$this->customer_thread['id_product'])             );         }  public function sendMessage()                     '{lastname}' => '',                     '{order_name}' => '-',                     '{attached_file}' => '-',                     '{message}' => Tools::nl2br(Tools::stripslashes($message)),                     '{email}' =>  $from,                     '{product_name}' => '',                 ];

Fixed version (after fix):
 public function getWidgetVariables($hookName = null, array $configuration = [])             }         }         $this->contact['contacts'] = $this->getTemplateVarContact();         $this->contact['message'] = Tools::getValue('message');         $this->contact['allow_file_upload'] = (bool) Configuration::get('PS_CUSTOMER_SERVICE_FILE_UPLOAD');          if (!(bool)Configuration::isCatalogMode()) { public function getTemplateVarOrders()     {         $orders = [];          if (empty($this->customer_thread['id_order'])             && isset($this->context->customer)             && $this->context->customer->isLogged()         ) {             $customer_orders = Order::getCustomerOrders($this->context->customer->id);              foreach ($customer_orders as $customer_order) { public function getTemplateVarOrders()                     $orders[$customer_order['id_order']]['products'] = $myOrder->getProducts();                 }             }         } elseif (isset($this->customer_thread['id_order']) && (int) $this->customer_thread['id_order'] > 0) {             $myOrder = new Order($this->customer_thread['id_order']);              if (Validate::isLoadedObject($myOrder)) { public function getTemplateVarOrders()             }         }          if (!empty($this->customer_thread['id_product'])) {             $id_order = isset($this->customer_thread['id_order']) ?                       (int) $this->customer_thread['id_order'] :                       0;              $orders[$id_order]['products'][(int)$this->customer_thread['id_product']] = $this->context->controller->objectPresenter->present(                 new Product((int) $this->customer_thread['id_product'])             );         }  public function sendMessage()                     '{lastname}' => '',                     '{order_name}' => '-',                     '{attached_file}' => '-',                     '{message}' => Tools::nl2br(Tools::htmlentitiesUTF8(Tools::stripslashes($message))),                     '{email}' =>  $from,                     '{product_name}' => '',                 ];

Patch:
patch: @@ -317,7 +317,7 @@ public function getWidgetVariables($hookName = null, array $configuration = [])
             }
         }
         $this->contact['contacts'] = $this->getTemplateVarContact();
-        $this->contact['message'] = html_entity_decode(Tools::getValue('message'));
+        $this->contact['message'] = Tools::getValue('message');
         $this->contact['allow_file_upload'] = (bool) Configuration::get('PS_CUSTOMER_SERVICE_FILE_UPLOAD');
 
         if (!(bool)Configuration::isCatalogMode()) {
@@ -388,9 +388,10 @@ public function getTemplateVarOrders()
     {
         $orders = [];
 
-        if (!isset($this->customer_thread['id_order'])
+        if (empty($this->customer_thread['id_order'])
             && isset($this->context->customer)
-            && $this->context->customer->isLogged()) {
+            && $this->context->customer->isLogged()
+        ) {
             $customer_orders = Order::getCustomerOrders($this->context->customer->id);
 
             foreach ($customer_orders as $customer_order) {
@@ -401,7 +402,7 @@ public function getTemplateVarOrders()
                     $orders[$customer_order['id_order']]['products'] = $myOrder->getProducts();
                 }
             }
-        } elseif (isset($this->customer_thread['id_order']) && (int)$this->customer_thread['id_order'] > 0) {
+        } elseif (isset($this->customer_thread['id_order']) && (int) $this->customer_thread['id_order'] > 0) {
             $myOrder = new Order($this->customer_thread['id_order']);
 
             if (Validate::isLoadedObject($myOrder)) {
@@ -411,13 +412,13 @@ public function getTemplateVarOrders()
             }
         }
 
-        if (isset($this->customer_thread['id_product'])) {
+        if (!empty($this->customer_thread['id_product'])) {
             $id_order = isset($this->customer_thread['id_order']) ?
-                      (int)$this->customer_thread['id_order'] :
+                      (int) $this->customer_thread['id_order'] :
                       0;
 
             $orders[$id_order]['products'][(int)$this->customer_thread['id_product']] = $this->context->controller->objectPresenter->present(
-                new Product((int)$this->customer_thread['id_product'])
+                new Product((int) $this->customer_thread['id_product'])
             );
         }
 
@@ -586,7 +587,7 @@ public function sendMessage()
                     '{lastname}' => '',
                     '{order_name}' => '-',
                     '{attached_file}' => '-',
-                    '{message}' => Tools::nl2br(Tools::stripslashes($message)),
+                    '{message}' => Tools::nl2br(Tools::htmlentitiesUTF8(Tools::stripslashes($message))),
                     '{email}' =>  $from,
                     '{product_name}' => '',
                 ];
path: contactform.php