← All changes | app/Services/FormBuilder/Components/SubmitButton.php +6 -2 6.2.5 → 6.2.14 View file →

		@@ -140,14 +140,18 @@
140	140	$buttonText = $data['settings']['btn_text'];
141	141	$html .= '<button ' . $atts . ' aria-label="' . esc_attr($this->removeShortcode($buttonText)) . '">' . fluentform_sanitize_html($buttonText) . '</button>'; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- $atts is escaped before being passed in.
142	142	}
143	143
	144	+ // SECURITY (FINDING-12): the custom-button style map keys and values are user-controlled
	145	+ // and unsanitized at save; a value like "#fff}</style><script>..." would break out of the
	146	+ // <style> element. fluentformSanitizeCSS() blanks any CSS containing a tag pattern.
	147	+ $styles = fluentformSanitizeCSS($styles);
144	148	if ($styles) {
145	149	if (did_action('wp_footer') || Helper::isBlockEditor()) {
146		- $html .= '<style>' . $styles . '</style>'; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- $styles is escaped before being passed in.
	150	+ $html .= '<style>' . $styles . '</style>'; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- $styles is sanitized via fluentformSanitizeCSS().
147	151	} else {
148	152	add_action('wp_footer', function () use ($styles) {
149		- echo '<style>' . $styles . '</style>'; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- $styles is escaped before being passed in.
	153	+ echo '<style>' . $styles . '</style>'; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- $styles is sanitized via fluentformSanitizeCSS().
150	154	});
151	155	}
152	156	}
153	157