Survey: Stored XSS with TinyMCE

Signed-off-by: Releasemanager <webmaster@ilias.de>

Author: ZallaxDev

components/ILIAS/Survey/Editing/class.ilSurveyEditorGUI.php

@@ -1027,14 +1027,13 @@ public function saveHeadingObject(): void
 
         $form = $this->initHeadingForm($q_id);
         if ($form->checkInput()) {
-            $this->object->saveHeading(
-                ilUtil::stripSlashes(
-                    $form->getInput("heading"),
-                    true,
-                    ilObjAdvancedEditing::_getUsedHTMLTagsAsString("survey")
-                ),
-                $form->getInput("insertbefore")
-            );
+            $tags = ilObjAdvancedEditing::_getUsedHTMLTags("survey");
+            $purifier = new HTMLPurifier($tags);
+            $heading = $form->getInput("heading");
+
+            $heading = $purifier->purify($heading);
+
+            $this->object->saveHeading($heading, $form->getInput("insertbefore"));
             $this->ctrl->redirect($this, "questions");
         }
 

components/ILIAS/Survey/Settings/class.SettingsFormGUI.php

@@ -20,9 +20,11 @@
 
 namespace ILIAS\Survey\Settings;
 
+use HTMLPurifier;
 use ILIAS\Survey\InternalGUIService;
 use ILIAS\Survey\Mode\UIModifier;
 use ILIAS\Survey\InternalDomainService;
+use ilObjAdvancedEditing;
 
 /**
  * Settings form
@@ -883,8 +885,15 @@ public function saveForm(
         } else {
             $survey->setEndDate("");
         }
-        $survey->setIntroduction($form->getInput("introduction"));
-        $survey->setOutro($form->getInput("outro"));
+        $tags = ilObjAdvancedEditing::_getUsedHTMLTags("survey");
+        $purifier = new HTMLPurifier($tags);
+
+        $introduction = $form->getInput("introduction");
+        $introduction = $purifier->purify($introduction);
+        $survey->setIntroduction($introduction);
+        $outro = $form->getInput("outro");
+        $outro = $purifier->purify($outro);
+        $survey->setOutro($outro);
         $survey->setShowQuestionTitles((bool) $form->getInput("show_question_titles"));
 
         // "separate mail for each participant finished"

components/ILIAS/SurveyQuestionPool/Questions/class.SurveyQuestionGUI.php

@@ -328,7 +328,14 @@ protected function saveForm(): bool
             $this->object->label = ($form->getInput("label"));
             $this->object->setAuthor($form->getInput("author"));
             $this->object->setDescription($form->getInput("description"));
-            $this->object->setQuestiontext($form->getInput("question"));
+
+            $tags = ilObjAdvancedEditing::_getUsedHTMLTags("survey");
+            $purifier = new HTMLPurifier($tags);
+            $question = $form->getInput("question");
+
+            $question = $purifier->purify($question);
+
+            $this->object->setQuestiontext($question);
             $this->object->setObligatory($form->getInput("obligatory"));
 
             $this->importEditFormValues($form);