Imported RichEditor custom block previews can be used for XSS
概要
The RichEditor trusts preview metadata embedded in imported custom block HTML. When a user pastes or drops HTML containing a custom block with a crafted data-preview attribute, the editor decodes the value and renders it without sanitization. An attacker can therefore execute JavaScript in the p...
影響パッケージ
| 種類 | パッケージ | 影響を受ける版 | 直った版 |
|---|---|---|---|
| composer | filament/forms |
>= 4.0.0, < 4.15.0 |
>= 4.15.0 |
| composer | filament/forms |
>= 5.0.0, < 5.10.0 |
>= 5.10.0 |
原文の説明 取得元が公開している説明をそのまま載せています (多くは英語)。
The RichEditor trusts preview metadata embedded in imported custom block HTML. When a user pastes or drops HTML containing a custom block with a crafted data-preview attribute, the editor decodes the value and renders it without sanitization. An attacker can therefore execute JavaScript in the panel's origin when a user copies content from an attacker-controlled page and pastes it into the editor.
出典: GitHub Repository Security Advisories (Game のスタック) GitHub Advisory OSV
参照URL
- GITHUB_REPO_ADVISORY filamentphp/filament