kristijanhusak/laravel-form-builder

XSS: Static form fields are not properly escaped

Open

#327 opened on Feb 17, 2017

 (4 comments) (0 reactions) (0 assignees)PHP (305 forks)github user discovery
enhancementhelp wanted

Repository metrics

Stars
 (1,715 stars)
PR merge metrics
 (No merged PRs in 30d)

Description

Hey, I was testing my laravel project for XSS vulnerabilities when I noticed that static form fields are not escaped.

How to reproduce / proof of concept: Using the default laravel auth system, register a new user and set <script>alert('danger');</script> as name. Add a new formbuilder form and add 'name' as a static field.

use Kris\LaravelFormBuilder\Form;

class EditUserForm extends Form
{
    public function buildForm()
    {
        $this
          ->add('name', 'static')
...

Create a simple view and controller for the form, set the user as model and the script will execute when you open the page (Tested with Chromium Version 55.0.2883.87 on linux mint).

To be clear, this is not a major security issue. You can and should prevent this by validating/sanitising the user input. However, static fields are pretty useful and escaping the data won't hurt performance while adding an additional layer of security.

Contributor guide