alchemy_cms 8.3.7 → 8.3.8

data/app/javascript/alchemy_admin/components/attachment_select.js

@@ -1,4 +1,7 @@
-import { RemoteSelect } from "alchemy_admin/components/remote_select"
+import {
+  RemoteSelect,
+  escapeHtml
+} from "alchemy_admin/components/remote_select"
 
 export class AttachmentSelect extends RemoteSelect {
   _renderResult(item) {
@@ -15,7 +18,7 @@ export class AttachmentSelect extends RemoteSelect {
   _renderListEntry(attachment, term) {
     return `
       <div class="attachment-select--attachment">
-        <alchemy-icon name="${attachment.icon_css_class}"></alchemy-icon>
+        <alchemy-icon name="${escapeHtml(attachment.icon_css_class)}"></alchemy-icon>
         <span class="attachment-select--attachment-name">${this._hightlightTerm(attachment.name, term)}</span>
       </div>
     `

data/app/javascript/alchemy_admin/components/node_select.js

@@ -1,4 +1,7 @@
-import { RemoteSelect } from "alchemy_admin/components/remote_select"
+import {
+  RemoteSelect,
+  escapeHtml
+} from "alchemy_admin/components/remote_select"
 
 class NodeSelect extends RemoteSelect {
   _searchQuery(term, page) {
@@ -23,7 +26,7 @@ class NodeSelect extends RemoteSelect {
    * @private
    */
   _renderListEntry(node, term) {
-    const ancestors = node.ancestors.map((a) => a.name)
+    const ancestors = node.ancestors.map((a) => escapeHtml(a.name))
     const seperator = `<alchemy-icon name="arrow-right-s"></alchemy-icon>`
 
     return `
@@ -38,7 +41,7 @@ class NodeSelect extends RemoteSelect {
           </span>
         </div>
         <div class="node-select--node-url">
-          ${node.url || ""}
+          ${escapeHtml(node.url || "")}
         </div>
       </div>
     `

data/app/javascript/alchemy_admin/components/page_select.js

@@ -1,4 +1,7 @@
-import { RemoteSelect } from "alchemy_admin/components/remote_select"
+import {
+  RemoteSelect,
+  escapeHtml
+} from "alchemy_admin/components/remote_select"
 
 export class PageSelect extends RemoteSelect {
   get pageId() {
@@ -30,7 +33,7 @@ export class PageSelect extends RemoteSelect {
    * @private
    */
   _renderResult(page) {
-    return page.text || page.name
+    return escapeHtml(page.text || page.name)
   }
 
   /**
@@ -46,11 +49,11 @@ export class PageSelect extends RemoteSelect {
         <div class="page-select--top">
           <alchemy-icon name="file-3"></alchemy-icon>
           <span class="page-select--page-name">${this._hightlightTerm(page.name, term)}</span>
-          <span class="page-select--site-name">${page.site.name}</span>
+          <span class="page-select--site-name">${escapeHtml(page.site.name)}</span>
         </div>
         <div class="page-select--bottom">
-          <span class="page-select--page-urlname">${page.url_path}</span>
-          <span class="page-select--language-code">${page.language_code}</span>
+          <span class="page-select--page-urlname">${escapeHtml(page.url_path)}</span>
+          <span class="page-select--language-code">${escapeHtml(page.language_code)}</span>
         </div>
       </div>
     `

data/app/javascript/alchemy_admin/components/remote_select.js

@@ -1,7 +1,41 @@
 import { setupSelectLocale } from "alchemy_admin/i18n"
 
+/**
+ * Escapes a string for use within HTML. Select2 hands the return value of
+ * `formatResult`/`formatSelection` straight to jQuery, so everything woven into
+ * those templates has to be escaped here.
+ * @param {string} value
+ * @returns {string}
+ */
+export function escapeHtml(value) {
+  return `${value}`
+    .replace(/&/g, "&")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;")
+    .replace(/"/g, "&quot;")
+}
+
+/**
+ * Escapes a string for literal use inside a `RegExp`, so a term with
+ * metacharacters (e.g. `(`) matches itself instead of being compiled as a
+ * pattern, which could match the wrong text or throw a SyntaxError.
+ * @param {string} value
+ * @returns {string}
+ */
+export function escapeRegExp(value) {
+  return String(value).replace(/[.*+?^${}()|[\]\\]/g, "\\$&")
+}
+
 export function hightlightTerm(name, term) {
-  return name.replace(new RegExp(term, "gi"), (match) => `<em>${match}</em>`)
+  // The result is rendered raw as the entry's name, so the name must be escaped
+  // before the term markup is woven in — otherwise a crafted name (e.g. a menu
+  // node title) is a stored XSS sink.
+  const escapedName = escapeHtml(name)
+  if (!term) return escapedName
+  return escapedName.replace(
+    new RegExp(escapeRegExp(term), "gi"),
+    (match) => `<em>${match}</em>`
+  )
 }
 
 export class RemoteSelect extends HTMLElement {

data/app/stylesheets/alchemy/admin/_tom-select.scss

@@ -229,6 +229,7 @@
   .option {
     padding: var(--spacing-2);
     cursor: pointer;
+    min-height: 2.75em;
 
     .highlight {
       text-decoration: underline;

data/app/stylesheets/alchemy/admin/forms.scss

@@ -128,7 +128,8 @@ form {
   }
 
   .field_with_errors {
-    input[type="text"],
+    &:not(:has(.ts-control)) input[type="text"],
+    .ts-control,
     input[type="email"],
     input[type="password"],
     textarea,

data/app/views/alchemy/admin/nodes/_page_nodes.html.erb

@@ -7,11 +7,13 @@
       <th class="tools"></th>
     </tr>
     <% nodes = @page.nodes.select(&:persisted?) %>
-    <% seperator = '<alchemy-icon name="arrow-right-s" style="vertical-align: text-bottom"></alchemy-icon>' %>
+    <% seperator = '<alchemy-icon name="arrow-right-s" style="vertical-align: text-bottom"></alchemy-icon>'.html_safe %>
     <% if nodes.length > 0 %>
       <% nodes.each do |node| %>
         <tr class="even">
-          <td><%== node.ancestors.map(&:name).join(seperator) %><%== seperator %><strong><%== node.name %></strong></td>
+          <td>
+            <%= safe_join(node.ancestors.map(&:name), seperator) %><%= seperator %><strong><%= node.name %></strong>
+          </td>
           <td class="tools">
             <sl-tooltip content="<%= Alchemy.t("delete_node") %>">
               <%= link_to render_icon(:minus),

data/lib/alchemy/version.rb

@@ -3,7 +3,7 @@
 module Alchemy
   extend self
 
-  VERSION = "8.3.7"
+  VERSION = "8.3.8"
 
   def version
     VERSION

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: alchemy_cms
 version: !ruby/object:Gem::Version
-  version: 8.3.7
+  version: 8.3.8
 platform: ruby
 authors:
 - Thomas von Deyen