Skip to content

Commit ceb305d

Browse files
author
Hwashiang Yu
committed
Merge remote-tracking branch 'origin/MC-5835' into cms-team-1-delivery
2 parents 49ddd81 + 5fd7d28 commit ceb305d

File tree

5 files changed

+71
-5
lines changed

5 files changed

+71
-5
lines changed

‎app/code/Magento/PageBuilder/Test/Mftf/ActionGroup/ContentTypeProductsActionGroup.xml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -77,7 +77,7 @@
7777
<actionGroup name="addCategoryConditionToProductsBlock">
7878
<arguments>
7979
<argument name="page" defaultValue=""/>
80-
<argument name="category" defaultValue=""/>
80+
<argument name="category" defaultValue="" type="string"/>
8181
<argument name="conditionIndex" defaultValue="1" type="string"/>
8282
</arguments>
8383
<waitForElementVisible selector="{{page.conditionsList}}" stepKey="waitForConditionsToLoad"/>

‎app/code/Magento/PageBuilder/Test/Mftf/Data/CommonContentTypeData.xml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -113,4 +113,16 @@
113113
<data key="name">Box Shadow</data>
114114
<data key="value">rgb(153, 153, 153) 0px 0px 0px 1px</data>
115115
</entity>
116+
<!-- Message -->
117+
<entity name="PageBuilderMessageProperty_WordBreak" type="pagebuilder_message_property">
118+
<data key="name">Message Text</data>
119+
<data key="section">contents</data>
120+
<data key="role">textarea</data>
121+
<data key="fieldName">message</data>
122+
<data key="value">Magento1111111 Page11111111111</data>
123+
</entity>
124+
<!-- XSS Payload -->
125+
<entity name="PageBuilderXSSPayloadProperty" type="pagebuilder_xss_payload">
126+
<data key="value">&gt;&lt;img src=x onerror=throw(1)&gt;</data>
127+
</entity>
116128
</entities>

‎app/code/Magento/PageBuilder/Test/Mftf/Test/AdminPageBuilderProductsTest.xml

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1359,4 +1359,54 @@
13591359
<expectedResult type="variable">productActionsWidthFrontend</expectedResult>
13601360
</assertGreaterThan>
13611361
</test>
1362+
<test name="ProductConditionsInvulnerableToXSS">
1363+
<annotations>
1364+
<features value="PageBuilder"/>
1365+
<stories value="Products"/>
1366+
<title value="Product Content Type is invulnerable to XSS via product condition payload injection"/>
1367+
<description value="As a Content Manager I want Product Content Type to be invulnerable to XSS via product condition payload injection so that the security of my admin experience is retained"/>
1368+
<severity value="CRITICAL"/>
1369+
<useCaseId value="MC-5835"/>
1370+
<testCaseId value="MC-6486"/>
1371+
<group value="pagebuilder"/>
1372+
<group value="pagebuilder-products"/>
1373+
<group value="pagebuilder-security"/>
1374+
</annotations>
1375+
<before>
1376+
<actionGroup ref="LoginAsAdmin" stepKey="loginAsAdmin"/>
1377+
<actionGroup ref="navigateToAPageWithPageBuilder" stepKey="navigateToAPageWithPageBuilder"/>
1378+
<actionGroup ref="switchToPageBuilderStage" stepKey="switchToPageBuilderStage"/>
1379+
</before>
1380+
<after>
1381+
<actionGroup ref="logout" stepKey="logout"/>
1382+
</after>
1383+
<actionGroup ref="addPageBuilderPageTitle" stepKey="enterPageTitle">
1384+
<argument name="contentType" value="PageBuilderProductsContentType"/>
1385+
</actionGroup>
1386+
<actionGroup ref="expandPageBuilderPanelGroup" stepKey="expandPageBuilderPanelGroup">
1387+
<argument name="group" value="PageBuilderProductsContentType"/>
1388+
</actionGroup>
1389+
<actionGroup ref="dragContentTypeToStage" stepKey="dragProductsOntoStage">
1390+
<argument name="contentType" value="PageBuilderProductsContentType"/>
1391+
</actionGroup>
1392+
<actionGroup ref="openPageBuilderEditPanel" stepKey="openEditAfterDrop">
1393+
<argument name="contentType" value="PageBuilderProductsContentType"/>
1394+
</actionGroup>
1395+
<actionGroup ref="addCategoryConditionToProductsBlock" stepKey="addCategory">
1396+
<argument name="page" value="ProductsContentTypeForm"/>
1397+
<argument name="category" value="{{PageBuilderXSSPayloadProperty.value}}"/>
1398+
</actionGroup>
1399+
<actionGroup ref="saveEditPanelSettings" stepKey="saveEditPanelSettings"/>
1400+
<!-- Validate Stage -->
1401+
<comment userInput="Validate Stage" stepKey="commentValidateStage"/>
1402+
<dontSeeJsError stepKey="doNotSeeAnyJSErrorsOnStage"/>
1403+
<actionGroup ref="saveAndContinueEditCmsPage" stepKey="saveAndContinueEditCmsPage"/>
1404+
<dontSeeJsError stepKey="doNotSeeAnyJSErrorsOnStageAfterSaving"/>
1405+
<!-- Validate Storefront -->
1406+
<comment userInput="Validate Storefront" stepKey="commentValidateStorefront"/>
1407+
<actionGroup ref="navigateToStoreFront" stepKey="navigateToStoreFront">
1408+
<argument name="contentType" value="PageBuilderProductsContentType"/>
1409+
</actionGroup>
1410+
<dontSeeJsError stepKey="doNotSeeAnyJSErrorsOnStorefront"/>
1411+
</test>
13621412
</tests>

‎app/code/Magento/PageBuilder/view/adminhtml/web/js/content-type/products/mass-converter/widget-directive.js

Lines changed: 2 additions & 2 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎app/code/Magento/PageBuilder/view/adminhtml/web/ts/js/content-type/products/mass-converter/widget-directive.ts

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,9 @@ export default class WidgetDirective extends BaseWidgetDirective {
6060
return content.replace(/\{/g, "^[")
6161
.replace(/\}/g, "^]")
6262
.replace(/"/g, "`")
63-
.replace(/\\/g, "|");
63+
.replace(/\\/g, "|")
64+
.replace(/</g, "&lt;")
65+
.replace(/>/g, "&gt;");
6466
}
6567

6668
/**
@@ -71,6 +73,8 @@ export default class WidgetDirective extends BaseWidgetDirective {
7173
return content.replace(/\^\[/g, "{")
7274
.replace(/\^\]/g, "}")
7375
.replace(/`/g, "\"")
74-
.replace(/\|/g, "\\");
76+
.replace(/\|/g, "\\")
77+
.replace(/&lt;/g, "<")
78+
.replace(/&gt;/g, ">");
7579
}
7680
}

0 commit comments

Comments
 (0)