Contrib.social

Invalid json+ld data when malicious data is entered

Open on Drupal.org →
Created on 13 May 2024, 9 months ago
Updated 11 July 2024, 7 months ago

When malicious data is passed in the url, invalid json+ld data is generated. This could possibly lead to security issues?

This can be reproduced by requesting a page using the following wget command:

wget http://localhost/index.php/filter/WOORD%5c%22}]DitMagNietKunnen,alert(1)" --content-on-error

Which leads to invalid json+ld data in ListItem 3:

<script type="application/ld+json">
{
          "@context": "https://schema.org",
          "@type": "BreadcrumbList",
          "itemListElement": [{
            "@type": "ListItem",
            "position": "1",
            "name": "Home",
            "item": "http://localhost/index.php/"
          },{
              "@type": "ListItem",
              "position": "2",
              "name": "Filter",
              "item": "http://localhost/index.php/"
            },{
              "@type": "ListItem",
              "position": "3",
              "name": "WOORD\\"}]DitMagNietKunnen,alert(1)",
              "item": "http://localhost/index.php/"
            }]}
</script>

I don't know if there is a specific reason why the EasyBreadcrumbStructuredDataJsonLd class generates the json+ld data by concatenating strings, but I think that should be replaced by json_encode. I'll create a MR for that shortly.

🐛 Bug report
Status

Fixed

Version

2.0

Component

Code

Created by

🇳🇱Netherlands Ruuds

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Merge Requests

Comments & Activities

contrib.social Blog FAQ Discussions
Production build 0.71.5 2024