From dcf22a42c940d90c2a213082792ce6d5c2c1a22d Mon Sep 17 00:00:00 2001
From: Alex Pott <alex.a.pott@googlemail.com>
Date: Thu, 5 Jan 2023 18:50:37 +0000
Subject: [PATCH] Issue #3331205 by larowlan, sanderwind: SSTI possible via
translation of "Language" in CKEditor Language plugin
---
core/modules/ckeditor/src/Plugin/CKEditorPlugin/Language.php | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/core/modules/ckeditor/src/Plugin/CKEditorPlugin/Language.php b/core/modules/ckeditor/src/Plugin/CKEditorPlugin/Language.php
index 5334bae991da..d427e863cc37 100644
--- a/core/modules/ckeditor/src/Plugin/CKEditorPlugin/Language.php
+++ b/core/modules/ckeditor/src/Plugin/CKEditorPlugin/Language.php
@@ -87,7 +87,10 @@ public function getButtons() {
'label' => $label,
'image_alternative' => [
'#type' => 'inline_template',
- '#template' => '<a href="#" class="cke-icon-only" role="button" title="' . $label . '" aria-label="' . $label . '"><span class="cke_button_icon cke_button__language_icon">' . $label . '</span></a>',
+ '#template' => '<a href="#" class="cke-icon-only" role="button" title="{{ label }}" aria-label="{{ label }}"><span class="cke_button_icon cke_button__language_icon">{{ label }}</span></a>',
+ '#context' => [
+ 'label' => $label,
+ ],
],
],
];
--
GitLab