Verified Commit 15e81137 authored by Dave Long's avatar Dave Long
Browse files

fix: #3607797 Potential XSS in block.admin.js 

By: prudloff
By: smustgrave
By: godotislate
By: brandonlira
(cherry picked from commit 6d0b1224)
parent 90b4a070

core/modules/block/js/block.admin.js

+1 −1
Original line number Diff line number Diff line
@@ -23,7 +23,7 @@ 
  Drupal.behaviors.blockFilterByText = {

    attach(context, settings) {

      const $input = $(once('block-filter-text', 'input.block-filter-text'));

      const $table = $($input.attr('data-element'));

      const $table = $(document.querySelectorAll($input.attr('data-element')));

      let $filterRows;



      /**

core/modules/block/tests/modules/block_test/src/Plugin/Block/TestXssBlock.php

0 → 100644
+31 −0
Original line number Diff line number Diff line 
<?php



declare(strict_types=1);



namespace Drupal\block_test\Plugin\Block;



use Drupal\Component\Utility\Html;

use Drupal\Core\Block\Attribute\Block;

use Drupal\Core\Block\BlockBase;

use Drupal\Core\Render\Markup;

use Drupal\Core\StringTranslation\TranslatableMarkup;



/**

 * Provides a block containing an XSS payload.

 */

#[Block(

  id: "test_xss",

  admin_label: new TranslatableMarkup("XSS payload"),

)]

class TestXssBlock extends BlockBase {



  /**

   * {@inheritdoc}

   */

  public function build(): array {

    $payload = '<img src=x onerror="window.XSS = true;">';



    return ['#markup' => Markup::create('<input class="block-filter-text" data-element="' . Html::escape($payload) . '">')];

  }



}

core/modules/block/tests/src/FunctionalJavascript/BlockFilterTest.php

+8 −1
Original line number Diff line number Diff line
@@ -19,7 +19,7 @@ class BlockFilterTest extends WebDriverTestBase { 
  /**

   * {@inheritdoc}

   */

  protected static $modules = ['user', 'block'];

  protected static $modules = ['user', 'block', 'block_test'];



  /**

   * {@inheritdoc}
@@ -82,6 +82,13 @@ public function testBlockFilter(): void { 
    $this->assertCount(0, $visible_rows);

    $expected_message = '0 blocks are available in the modified list.';

    $this->assertAnnounceContains($expected_message);



    $this->placeBlock('test_xss');

    $this->failOnJavascriptConsoleErrors = FALSE;

    $this->drupalGet('admin/structure/block');



    // If the XSS variable exists, it means the payload has been executed.

    $this->assertJsCondition("typeof window.XSS === 'undefined'");

  }



  /**