ABC
The theme does not sufficiently sanitise menu link titles before inserting them into HTML class attributes. Anyone with no login could view restricted information and alter or add new data by injecting malicious scripts.
- Who could do thisAnyone visiting the site. No login needed.
- Does it apply to youAn attacker must be able to create or modify menu link titles.
- Has it been used in attacksNo sign of it.
- How urgentDrupal rates this critical. Cyber Essentials expects a fix within 14 days. Do it this week.
Tell your developerUpdate ABC to 8.x-1.25 or 2.0.1, whichever branch you are on.
For developers: what the fix changed
The fix updates `preprocessMenu` and introduces `prepareMenuTitles` in `src/Hook/AbcHooks.php` to strictly validate Font Awesome class names using a regular expression and escape the menu link title using `Html::escape()` before inserting it into the HTML class attribute.
Also in this release The release also fixes multilingual slide URLs, custom CSS file path resolution, and filters unsafe protocols in social links.
CHANGELOG.txt+15 −0abc.info.yml+74 −75src/Hook/AbcHooks.php+164 −14 fixtemplates/content/comment.html.twig+1 −0templates/content/node--article.html.twig+5 −4templates/content/node--blog-post.html.twig+5 −4templates/content/node--book.html.twig+5 −4templates/content/node--forum.html.twig+4 −3templates/content/node--page.html.twig+5 −4templates/content/node.html.twig+5 −4templates/includes/slider.html.twig+21 −21templates/includes/social_links.html.twig+15 −15