The readmoreLink setting is vulnerable to a XSS vulnerability.
Use this config:
moreInfoLink: true
readmoreLink: '"><img src="x" onerror="alert(''foo'')">'
tarteaucitron.js does not sanitize the value before using it in the href attribute.
Html::escape() could be used to sanitize the string.
Fixed
1.0
Code
It is used for security vulnerabilities which do not need a security advisory. For example, security issues in projects which do not have security advisory coverage, or forward-porting a change already disclosed in a security advisory. See Drupal’s security advisory policy for details. Be careful publicly disclosing security vulnerabilities! Use the “Report a security vulnerability” link in the project page’s sidebar. See how to report a security issue for details.
Html::escape() might not be enough, UrlHelper::filterBadProtocol() is probably the correct solution here.
Automatically closed - issue fixed for 2 weeks with no activity.