Skip to content

Commit 0a5966d

Browse files
ugoliniriccardougoliniriccardo
authored
XSS Vulnerability fix
1 parent d88fd69 commit 0a5966d

1 file changed

Lines changed: 82 additions & 57 deletions

File tree

‎view/adminhtml/templates/detail.phtml‎

Lines changed: 82 additions & 57 deletions
Original file line numberDiff line numberDiff line change
@@ -6,99 +6,124 @@
66

77
// @codingStandardsIgnoreFile
88
/**
9-
* @var $block Template
9+
* @var $block \Magento\Framework\View\Element\Template
1010
*/
1111

12-
/** @var Detail $viewModel */
13-
14-
use GhostUnicorns\WebapiLogs\ViewModel\Detail;
15-
use Magento\Framework\View\Element\Template;
12+
/** @var \GhostUnicorns\WebapiLogs\ViewModel\Detail $viewModel */
1613

1714
$viewModel = $block->getViewModel();
18-
1915
$log = $viewModel->getLog();
16+
17+
/** @var \Magento\Framework\Escaper $escaper */
18+
$escaper = $block->escapeHtml;
19+
$escaper = $block->getEscaper();
2020
?>
2121

22-
<h1>Log id: <?= $log->getData('log_id') ?></h1>
22+
<h1>Log id: <?= $escaper->escapeHtml((string)$log->getData('log_id')) ?></h1>
2323
<br/>
24+
2425
<h1>Request</h1>
26+
2527
<p><b>requestor_ip:</b></p>
26-
<p><?= $log->getData('requestor_ip') ?></p>
28+
<p><?= $escaper->escapeHtml((string)$log->getData('requestor_ip')) ?></p>
2729
<br/>
30+
2831
<p><b>request_url:</b></p>
29-
<p><?= $log->getData('request_url') ?></p>
32+
<?php
33+
$requestUrl = (string)$log->getData('request_url');
34+
?>
35+
<p>
36+
<a href="<?= $escaper->escapeUrl($requestUrl) ?>" target="_blank" rel="noopener">
37+
<?= $escaper->escapeHtml($requestUrl) ?>
38+
</a>
39+
</p>
3040
<br/>
41+
3142
<p><b>request_method:</b></p>
32-
<p><?= $log->getData('request_method') ?></p>
43+
<p><?= $escaper->escapeHtml((string)$log->getData('request_method')) ?></p>
3344
<br/>
45+
3446
<p><b>request_body:</b> <button class="js_beauty_json">Prettify JSON</button></p>
35-
<p><?= $log->getData('request_body') ?></p>
47+
<pre class="js_json_target" style="white-space: pre-wrap; word-break: break-word;">
48+
<?= $escaper->escapeHtml((string)$log->getData('request_body')) ?>
49+
</pre>
3650
<br/>
51+
3752
<p><b>request_headers:</b></p>
38-
<p><?= $log->getData('request_headers') ?></p>
53+
<pre style="white-space: pre-wrap; word-break: break-word;">
54+
<?= $escaper->escapeHtml((string)$log->getData('request_headers')) ?>
55+
</pre>
3956
<br/>
57+
4058
<h1>Response</h1>
59+
4160
<p><b>response_code:</b></p>
42-
<p><?= $log->getData('response_code') ?></p>
61+
<p><?= $escaper->escapeHtml((string)$log->getData('response_code')) ?></p>
4362
<br/>
63+
4464
<p><b>response_body:</b> <button class="js_beauty_json">Prettify JSON</button></p>
45-
<p><?= $log->getData('response_body') ?></p>
65+
<pre class="js_json_target" style="white-space: pre-wrap; word-break: break-word;">
66+
<?= $escaper->escapeHtml((string)$log->getData('response_body')) ?>
67+
</pre>
4668
<br/>
69+
4770
<p><b>request_datetime:</b></p>
48-
<p><?= $log->getData('request_datetime') ?></p>
71+
<p><?= $escaper->escapeHtml((string)$log->getData('request_datetime')) ?></p>
4972
<br/>
73+
5074
<p><b>response_datetime:</b></p>
51-
<p><?= $log->getData('response_datetime') ?></p>
75+
<p><?= $escaper->escapeHtml((string)$log->getData('response_datetime')) ?></p>
5276
<br/>
77+
5378
<p><b>created_at:</b></p>
54-
<p><?= $log->getData('created_at') ?></p>
79+
<p><?= $escaper->escapeHtml((string)$log->getData('created_at')) ?></p>
5580
<br/>
5681

5782
<script>
5883
require([
5984
'jquery',
6085
'GhostUnicorns_WebapiLogs/js/js-beautify/beautify.min'
61-
], function (
62-
$,
63-
beautify
64-
) {
86+
], function ($, beautify) {
6587
'use strict';
6688

67-
$('.js_beauty_json').click(function (e) {
68-
let $button = $(e.target);
69-
let $target = $button.parent().next();
70-
let value = $target.text();
71-
72-
value = beautify.js_beautify(value, {
73-
"indent_size": 4,
74-
"indent_char": "&nbsp;",
75-
"indent_with_tabs": false,
76-
"editorconfig": false,
77-
"eol": "<br/>",
78-
"end_with_newline": false,
79-
"indent_level": 0,
80-
"preserve_newlines": true,
81-
"max_preserve_newlines": 10,
82-
"space_in_paren": false,
83-
"space_in_empty_paren": false,
84-
"jslint_happy": false,
85-
"space_after_anon_function": false,
86-
"space_after_named_function": false,
87-
"brace_style": "collapse",
88-
"unindent_chained_methods": false,
89-
"break_chained_methods": false,
90-
"keep_array_indentation": false,
91-
"unescape_strings": false,
92-
"wrap_line_length": 0,
93-
"e4x": false,
94-
"comma_first": false,
95-
"operator_position": "before-newline",
96-
"indent_empty_lines": false,
97-
"templating": ["auto"]
98-
});
99-
100-
$target.html(value);
101-
$button.hide();
102-
})
89+
$('.js_beauty_json').on('click', function (e) {
90+
var $button = $(e.target);
91+
var $target = $button.parent().next('.js_json_target');
92+
var value = $target.text(); // prende solo testo, niente HTML → sicuro
93+
94+
try {
95+
value = beautify.js_beautify(value, {
96+
"indent_size": 4,
97+
"indent_char": "&nbsp;",
98+
"indent_with_tabs": false,
99+
"editorconfig": false,
100+
"eol": "<br/>",
101+
"end_with_newline": false,
102+
"indent_level": 0,
103+
"preserve_newlines": true,
104+
"max_preserve_newlines": 10,
105+
"space_in_paren": false,
106+
"space_in_empty_paren": false,
107+
"jslint_happy": false,
108+
"space_after_anon_function": false,
109+
"space_after_named_function": false,
110+
"brace_style": "collapse",
111+
"unindent_chained_methods": false,
112+
"break_chained_methods": false,
113+
"keep_array_indentation": false,
114+
"unescape_strings": false,
115+
"wrap_line_length": 0,
116+
"e4x": false,
117+
"comma_first": false,
118+
"operator_position": "before-newline",
119+
"indent_empty_lines": false,
120+
"templating": ["auto"]
121+
});
122+
$target.html(value); // scrive HTML generato dal beautifier a partire da testo già escapato
123+
$button.hide();
124+
} catch (err) {
125+
console.error('Beautify error', err);
126+
}
127+
});
103128
});
104129
</script>

0 commit comments

Comments
 (0)