← All changes
|
app/Services/FormBuilder/Components/TabularGrid.php
+10
-5
6.2.5
→
6.2.14
View file →
| @@ -64,10 +64,13 @@ | ||
| 64 | 64 | if (ArrayHelper::get($data, 'settings.validation_rules.required.value')) { |
| 65 | 65 | $ariaRequired = 'true'; |
| 66 | 66 | } |
| 67 | 67 | |
| 68 | - $input = '<input aria-label="'. $row['name'] .'-'. $column['label'] . '" ' . $attributes . " {$isChecked} aria-invalid='false' aria-required={$ariaRequired}>"; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- $attributes is escaped before being passed in. | |
| 69 | - $elMarkup .= "<td data-label='" . fluentform_sanitize_html($column['label']) . "'>{$input}</td>"; | |
| 68 | + // SECURITY (FINDING-12): esc_attr the row/column labels before interpolating them | |
| 69 | + // into the double-quoted aria-label; save-time sanitizers do not encode quotes. | |
| 70 | + $input = '<input aria-label="'. esc_attr($row['name']) .'-'. esc_attr($column['label']) . '" ' . $attributes . " {$isChecked} aria-invalid='false' aria-required={$ariaRequired}>"; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- $attributes is escaped before being passed in. | |
| 71 | + $responsiveLabel = esc_attr(wp_strip_all_tags($column['label'])); | |
| 72 | + $elMarkup .= "<td data-label='{$responsiveLabel}'>{$input}</td>"; | |
| 70 | 73 | } |
| 71 | 74 | $elMarkup .= '</tr>'; |
| 72 | 75 | } |
| 73 | 76 | |
| @@ -74,13 +77,15 @@ | ||
| 74 | 77 | $elMarkup .= '</tbody></table>'; |
| 75 | 78 | |
| 76 | 79 | $elMarkup = "<div class='ff-el-input--content'>{$elMarkup}" . fluentform_sanitize_html($elementHelpMessage) . '</div>'; |
| 77 | 80 | |
| 81 | + // SECURITY (FINDING-12): esc_attr the attribute values interpolated into the single-quoted | |
| 82 | + // data-type / data-name / class attributes; sanitize_text_field at save does not encode quotes. | |
| 78 | 83 | $html = sprintf( |
| 79 | 84 | "<div data-type='%s' data-name='%s' class='%s'>%s", |
| 80 | - $data['attributes']['data-type'], | |
| 81 | - $data['attributes']['name'], | |
| 82 | - $data['attributes']['class'], | |
| 85 | + esc_attr($data['attributes']['data-type']), | |
| 86 | + esc_attr($data['attributes']['name']), | |
| 87 | + esc_attr($data['attributes']['class']), | |
| 83 | 88 | $elementLabel |
| 84 | 89 | ) . $elMarkup . '</div>'; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- $elementLabel is escaped before being passed in. |
| 85 | 90 | |
| 86 | 91 | $html = apply_filters_deprecated( |