Come together with the global Drupal community in Rotterdam, 28 Sept – 1 Oct 2026. Sessions, contribution, connection, and Early Bird savings until 8 June.This module allows an administrator to add code directly to a page with no filtering. That may be a path for an XSS attack. Fortunately, the module defines a new permission. Unfortunately the title of that permission is not clear enough in warning the admin that it is an "important" permission.
I suggest adding text (in a lot of places) that makes this more clear - project page, readme.txt, and in the permission name itself ("grant with care" or similar).
Comments
Comment #1
gregglesBumping to critical. I (in coordination and as part of the security team) need a response here or will need to take action directly.
Comment #2
jochen wendebaum commentedI just added some more intense and extensive information about the security concerns to the module description, also pointing out the other modules which should be used instead.
To the sec-team: if you think this module goes too far, please feel absoutly free to delete it. I wrote this module for my own use some time ago and wanted to share it, but I understand completly that it might introduce some security risks if used in a wrong way.
Comment #3
gregglesThanks for your help.
It would be great to have some text in the module itself - either in the permission name or the README or both.
Comment #4
sylvain lecoy commented