- Issue created by @prudloff
The module creates a Footnote text format and uses it to restrict which tags are allowed in footnote text.
But it seems this text format is not really enforced when rendering the footnote text.
This could allow injecting arbitrary JS in the page.
1. Create a text format with the footnotes filter.
2. In a CKE field using this format, use source editing to insert this HTML:
<p>
<footnotes data-text="<img src=x onload="alert()" onerror="alert()">" data-value="foo"> </footnotes>
</p>
3. When the node is displayed, the JS is executed.
This can be mitigated by having the "Limit allowed HTML tags and correct faulty HTML" filter run after "Footnotes filter" in the node text format.
The module should filter the footnote text with the filters from the Footnote format when displaying the text, not just when saving the modal.
Active
4.0
Footnotes
It is used for security vulnerabilities which do not need a security advisory. For example, security issues in projects which do not have security advisory coverage, or forward-porting a change already disclosed in a security advisory. See Drupal’s security advisory policy for details. Be careful publicly disclosing security vulnerabilities! Use the “Report a security vulnerability” link in the project page’s sidebar. See how to report a security issue for details.