← All changes | app/Services/FormBuilder/FormBuilder.php +6 -1 6.2.5 → 6.2.14 View file →

		@@ -577,11 +577,16 @@
577	577	protected function buildAttributes($attributes, $form = null)
578	578	{
579	579	$atts = '';
580	580	foreach ($attributes as $key => $value) {
	581	+ // SECURITY (FINDING-06): drop event-handler attribute keys and escape the key name
	582	+ // (author-controlled attribute keys are not allowlisted at save).
	583	+ if (preg_match('/^on[a-z]/i', (string) $key)) {
	584	+ continue;
	585	+ }
581	586	if ($value || 0 === $value || '0' === $value) {
582	587	$value = htmlspecialchars($value);
583		- $atts .= $key . '="' . $value . '" ';
	588	+ $atts .= esc_attr($key) . '="' . $value . '" ';
584	589	}
585	590	}
586	591	return $atts;
587	592	}