The newly added $labels['form_label'] and $labels['section_label'] need to be escaped in the comment-wrapper.tpl.php template file.

To reproduce, switch to stark or any theme which does not override core's comment-wrapper.tpl.php and inject some XSS in either the Comment section label or the New comment form label on the content type edit form, such as Comments <script>alert('section')</script>.

Given that this vulnerability requires the 'administer content types' permission, it does not need to go through the regular security team process.

CommentFileSizeAuthor
#1 1436286-1.patch660 bytespwolanin

Comments

pwolanin’s picture

pwolanin commented
Status: Active » Needs review
StatusFileSize
new 1436286-1.patch660 bytes

should be made safe in preprocess

pwolanin’s picture

pwolanin commented
Status: Needs review » Reviewed & tested by the community

scor confirmed in IRC that the fix looks right.

pwolanin’s picture

pwolanin commented
Status: Reviewed & tested by the community » Fixed

committed

jessebeach’s picture

jessebeach commented
Status: Fixed » Closed (fixed)

In the 7.x-1.x branch. To be included in an upcoming release.