Contrib.social

html encoded when result is selected

Open on Drupal.org →
Created on 27 June 2024, 6 months ago

Problem/Motivation

Follow-up from #3427028

When a facet result with HTML is added and selected in the facet results, it shows up encoded

Steps to reproduce

  1. Have a facet result containing a <img src="x" onerror="alert(`XSS`)">.
  2. Then start typing "a" in the autocomplete field.
  3. Select the item
  4. The item is shown as <img src="x" onerror="alert(`XSS`)">

Proposed resolution

Check to decode the value before returning

🐛 Bug report
Status

Needs work

Version

2.0

Component

Code

Created by

🇧🇪Belgium brentg Ghent

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Merge Requests

Comments & Activities

contrib.social Blog FAQ Discussions
Production build 0.71.5 2024