Block Attributes
The module does not sufficiently sanitise attributes against malicious scripts. An administrator account could view restricted information and alter or add new data through these custom attributes.
- Who could do thisOnly someone with an administrator login.
- Does it apply to youAn attacker must have the administer blocks access right.
- Has it been used in attacksNo sign of it.
- How urgentDrupal rates this moderately critical. Include it in your next routine update, within the month.
Tell your developerUpdate Block Attributes to 2.1.0.
For developers: what the fix changed
The fix introduces strict validation for attribute names using a regular expression in BlockAttributesChecker::isAttributeAllowed and adds a filterAttributeValues method to ensure only safe attributes are rendered. It also updates ConfigForm::validateForm to enforce these rules during configuration and adds an update hook in block_attributes.install to clean up existing invalid attributes.
Also in this release Added a cspell project words file to fix a misspelt word.
.cspell-project-words.txt+1 −0block_attributes.install+50 −0 fixblock_attributes.module+23 −4 fixsrc/BlockAttributesChecker.php+59 −3 fixsrc/Form/ConfigForm.php+14 −2 fix