Skip to content

Commit a98f366

Browse files
pawan-adobe-securitypawan-adobe-security
committed
Merge branch 'AC-10528' into cia-2.4.8-beta1-develop-bugfix-05202024
2 parents b96b542 + c31331f commit a98f366

File tree

3 files changed

+14
-88
lines changed

3 files changed

+14
-88
lines changed

‎app/code/Magento/Sales/Helper/Admin.php

Lines changed: 0 additions & 78 deletions
Original file line numberDiff line numberDiff line change
@@ -160,84 +160,6 @@ public function applySalableProductTypesFilter($collection)
160160
*/
161161
public function escapeHtmlWithLinks($data, $allowedTags = null)
162162
{
163-
if (!empty($data) && is_array($allowedTags) && in_array('a', $allowedTags)) {
164-
$wrapperElementId = uniqid();
165-
$domDocument = $this->domDocumentFactory->create();
166-
167-
$internalErrors = libxml_use_internal_errors(true);
168-
169-
$convmap = [0x80, 0x10FFFF, 0, 0x1FFFFF];
170-
$data = mb_encode_numericentity(
171-
$data,
172-
$convmap,
173-
'UTF-8'
174-
);
175-
176-
$domDocument->loadHTML(
177-
'<html><body id="' . $wrapperElementId . '">' . $data . '</body></html>'
178-
);
179-
180-
libxml_use_internal_errors($internalErrors);
181-
182-
$linkTags = $domDocument->getElementsByTagName('a');
183-
184-
foreach ($linkTags as $linkNode) {
185-
$linkAttributes = [];
186-
foreach ($linkNode->attributes as $attribute) {
187-
$linkAttributes[$attribute->name] = $attribute->value;
188-
}
189-
190-
foreach ($linkAttributes as $attributeName => $attributeValue) {
191-
if ($attributeName === 'href') {
192-
$url = $this->filterUrl($attributeValue ?? '');
193-
$url = $this->escaper->escapeUrl($url);
194-
$linkNode->setAttribute('href', $url);
195-
} else {
196-
$linkNode->removeAttribute($attributeName);
197-
}
198-
}
199-
}
200-
201-
$result = mb_decode_numericentity(
202-
// phpcs:ignore Magento2.Functions.DiscouragedFunction
203-
html_entity_decode(
204-
$domDocument->saveHTML(),
205-
ENT_QUOTES|ENT_SUBSTITUTE,
206-
'UTF-8'
207-
),
208-
$convmap,
209-
'UTF-8'
210-
);
211-
212-
preg_match('/<body id="' . $wrapperElementId . '">(.+)<\/body><\/html>$/si', $result, $matches);
213-
$data = !empty($matches) ? $matches[1] : '';
214-
}
215-
216163
return $this->escaper->escapeHtml($data, $allowedTags);
217164
}
218-
219-
/**
220-
* Filter the URL for allowed protocols.
221-
*
222-
* @param string $url
223-
* @return string
224-
*/
225-
private function filterUrl(string $url): string
226-
{
227-
if ($url) {
228-
//Revert the sprintf escaping
229-
// phpcs:ignore Magento2.Functions.DiscouragedFunction
230-
$urlScheme = parse_url($url, PHP_URL_SCHEME);
231-
$urlScheme = $urlScheme ? strtolower($urlScheme) : '';
232-
if ($urlScheme !== 'http' && $urlScheme !== 'https') {
233-
$url = null;
234-
}
235-
}
236-
237-
if (!$url) {
238-
$url = '#';
239-
}
240-
241-
return $url;
242-
}
243165
}

‎app/code/Magento/Sales/view/adminhtml/templates/order/comments/view.phtml

Lines changed: 12 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -5,13 +5,14 @@
55
*/
66

77
/** @var \Magento\Framework\View\Helper\SecureHtmlRenderer $secureRenderer */
8+
/** @var \Magento\Framework\Escaper $escaper */
89
?>
910
<?php if ($_entity = $block->getEntity()): ?>
1011
<div id="comments_block" class="edit-order-comments">
1112
<div class="order-history-block">
1213
<div class="admin__field field-row">
1314
<label class="admin__field-label"
14-
for="history_comment"><?= $block->escapeHtml(__('Comment Text')) ?></label>
15+
for="history_comment"><?= $escaper->escapeHtml(__('Comment Text')) ?></label>
1516
<div class="admin__field-control">
1617
<textarea name="comment[comment]"
1718
class="admin__control-textarea"
@@ -30,7 +31,7 @@
3031
id="history_notify"
3132
value="1" />
3233
<label class="admin__field-label"
33-
for="history_notify"><?= $block->escapeHtml(__('Notify Customer by Email')) ?></label>
34+
for="history_notify"><?= $escaper->escapeHtml(__('Notify Customer by Email')) ?></label>
3435
</div>
3536
<?php endif; ?>
3637
<div class="admin__field admin__field-option">
@@ -40,7 +41,7 @@
4041
class="admin__control-checkbox"
4142
value="1" />
4243
<label class="admin__field-label"
43-
for="history_visible"> <?= $block->escapeHtml(__('Visible on Storefront')) ?></label>
44+
for="history_visible"> <?= $escaper->escapeHtml(__('Visible on Storefront')) ?></label>
4445
</div>
4546
</div>
4647
<div class="order-history-comments-actions">
@@ -59,17 +60,20 @@
5960
<?= /* @noEscape */ $block->formatTime($_comment->getCreatedAt(), \IntlDateFormatter::MEDIUM) ?>
6061
</span>
6162
<span class="note-list-customer">
62-
<?= $block->escapeHtml(__('Customer')) ?>
63+
<?= $escaper->escapeHtml(__('Customer')) ?>
6364
<?php if ($_comment->getIsCustomerNotified()): ?>
64-
<span class="note-list-customer-notified"><?= $block->escapeHtml(__('Notified')) ?></span>
65+
<span class="note-list-customer-notified"><?= $escaper->escapeHtml(__('Notified')) ?></span>
6566
<?php else: ?>
6667
<span class="note-list-customer-not-notified">
67-
<?= $block->escapeHtml(__('Not Notified')) ?>
68+
<?= $escaper->escapeHtml(__('Not Notified')) ?>
6869
</span>
6970
<?php endif; ?>
7071
</span>
7172
<div class="note-list-comment">
72-
<?= $block->escapeHtml($_comment->getComment(), ['b', 'br', 'strong', 'i', 'u', 'a']) ?>
73+
<?= /* @noEscape */ nl2br($escaper->escapeHtml(
74+
$_comment->getComment(),
75+
['b', 'br', 'strong', 'i', 'u', 'a']
76+
))?>
7377
</div>
7478
</li>
7579
<?php endforeach; ?>
@@ -78,7 +82,7 @@
7882
<?php $scriptString = <<<script
7983
require(['prototype'], function(){
8084
submitComment = function() {
81-
submitAndReloadArea($('comments_block').parentNode, '{$block->escapeJs($block->getSubmitUrl())}')
85+
submitAndReloadArea($('comments_block').parentNode, '{$escaper->escapeJs($block->getSubmitUrl())}')
8286
};
8387
if ($('submit_comment_button')) {
8488
$('submit_comment_button').observe('click', submitComment);

‎dev/tests/integration/testsuite/Magento/Sales/Helper/AdminTest.php

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -76,7 +76,7 @@ public function escapeHtmlWithLinksDataProvider(): array
7676
],
7777
[
7878
'<a href=\"#\">Foo</a>',
79-
'<a href="#">Foo</a>',
79+
'<a href="%5C&quot;#%5C&quot;">Foo</a>',
8080
'allowedTags' => ['a'],
8181
],
8282
[
@@ -86,7 +86,7 @@ public function escapeHtmlWithLinksDataProvider(): array
8686
],
8787
[
8888
"<a href=\"javascript&colon;alert(59)\">Foo</a>",
89-
'<a href="#">Foo</a>',
89+
'<a href="javascript&amp;colon;alert(59)">Foo</a>',
9090
'allowedTags' => ['a'],
9191
],
9292
[

0 commit comments

Comments
 (0)