Values of variables are not sanitised

Problem/Motivation

Reporting this in the public issue queue as:

• This doesn't seem to be directly exploitable by anyone other than a trusted admin with just the module's code alone.
• This project doesn't currently have a stable release with Security coverage.

At present adobe_analytics\VariableFormatter::renderVariables sanitises the keys of variables, but not their values.

The token module may do some sanitisation, but values with no tokens pass through unfiltered.

The twig template then uses |raw to output the rendered variables.

This means it's possible to put an XSS payload into the value of a variable, and it will be sent to the browser without sanitisation.

In the case of putting XSS into the module's config, the 'Configure Adobe Analytics settings' permission is marked as restricted so should only be given to trusted users. Therefore this would not be treated as a security vulnerability even if the project had Security Coverage (which it currently does not).

However, there's also the hook_adobe_analytics_variables hook provided by the module whereby other code can add extra variables.

It's not hard to imagine another module putting something into the value of a variable that would be unsafe to render without any sanitisation, but that's what would currently happen.

Side note: the example hook implementation in the readme file is quite broken, but it illustrates setting a variable based on a http header. The example itself is not dangerous as only an item from a hard-coded list is used as the variable value, but it's not a big jump to go from that to setting a variable based on unsafe input.

Steps to reproduce

Example payload:

extra_variables:
  -
    name: foo
    value: '";alert(1);//'

Proposed resolution

Variables values should be sanitised as well as the keys.

Remaining tasks

tbc

User interface changes

tbc

API changes

tbc

Data model changes

tbc