The 2026 Drupal Business Survey is open. Your response will help shape the future of the Drupal business ecosystem.The block default symbols are not being sanitized before they are output to the screen causing an XSS error.
Steps to repeat:
1. browse to /admin/settings/stock
2. enter a javascript alert() into the 'Block Default Symbols' form field.
3. upon saving, the alert box is displayed.
4. the alert box is being displayed on all pages that include the block too.
| Comment | File | Size | Author |
|---|---|---|---|
| #1 | XSS-1371950-2.patch | 524 bytes | pfrilling |
Comments
Comment #1
pfrillingAttached is a patch file that fixes this issue.
Comment #2
izmeez commentedPatch applies without problem to the latest 6.x-1.dev release. Still in process of testing the module.
Comment #2.0
izmeez commentedSteps #4 in steps to repeat was incorrect. The XSS was coming from the drupal_set_message().