{"id":3658,"date":"2013-11-29T13:55:41","date_gmt":"2013-11-29T15:55:41","guid":{"rendered":"http:\/\/blog.plataformatec.com.br\/?p=3658"},"modified":"2013-11-29T13:55:41","modified_gmt":"2013-11-29T15:55:41","slug":"xss-vulnerability-on-simple-form","status":"publish","type":"post","link":"https:\/\/blog.plataformatec.com.br\/2013\/11\/xss-vulnerability-on-simple-form\/","title":{"rendered":"XSS vulnerability on Simple Form"},"content":{"rendered":"<p>There is a XSS vulnerability on Simple Form&#8217;s label, hint and error options.<\/p>\n<p>Versions affected: >= 1.1.1<br \/>\nNot affected: &lt; 1.1.1<br \/>\nFixed versions: 3.0.1, 2.1.1<\/p>\n<h3>Impact<\/h3>\n<p>When Simple Form creates a label, hint or error message it marks the text as being HTML safe, even though it may contain HTML tags. In applications where the text of these helpers can be provided by the users, malicious values can be provided and Simple Form will mark it as safe.<\/p>\n<h3>Releases<\/h3>\n<p>The 3.0.1 and 2.1.1 releases are available at the normal locations.<\/p>\n<h3>Workarounds<\/h3>\n<p>If you are unable to upgrade, you can change your code to escape the input before sending to Simple Form<\/p>\n<pre lang=\"ruby\">\nf.input :name, label: html_escape(params[:label])\n<\/pre>\n<h3>Patches<\/h3>\n<p>To aid users who aren&#8217;t able to upgrade immediately we have provided patches. They are in git-am format and consist of a single changeset.<\/p>\n<ul>\n<li><a href=\"https:\/\/gist.github.com\/rafaelfranca\/ff2c89e7ca9da63aaf34\/raw\/e7ba922991b99c64e052304879109e20cd8b64e2\/3-0-xss-fix.patch\">3-0-xss-fix.patch<\/a> &#8211; Patch for 3.0 series <\/li>\n<li><a href=\"https:\/\/gist.github.com\/rafaelfranca\/a5d4a703a09e1f37c7dd\/raw\/1f48c75090b5d4e84ddea2fc8688fdfffb815a4f\/2-1-xss-fix.patch\">2-1-xss-fix.patch<\/a> &#8211; Patch for 2.1 series<\/li>\n<\/ul>\n<h3>Credits<\/h3>\n<p>Thank you to Paul McMahon from Doorkeeper for reporting the issue and working with us in a fix.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>There is a XSS vulnerability on Simple Form&#8217;s label, hint and error options. Fixed versions: 3.0.1, 2.1.1<\/p>\n","protected":false},"author":15,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"ngg_post_thumbnail":0,"footnotes":""},"categories":[1],"tags":[124,105],"aioseo_notices":[],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/blog.plataformatec.com.br\/wp-json\/wp\/v2\/posts\/3658"}],"collection":[{"href":"https:\/\/blog.plataformatec.com.br\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.plataformatec.com.br\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.plataformatec.com.br\/wp-json\/wp\/v2\/users\/15"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.plataformatec.com.br\/wp-json\/wp\/v2\/comments?post=3658"}],"version-history":[{"count":7,"href":"https:\/\/blog.plataformatec.com.br\/wp-json\/wp\/v2\/posts\/3658\/revisions"}],"predecessor-version":[{"id":3665,"href":"https:\/\/blog.plataformatec.com.br\/wp-json\/wp\/v2\/posts\/3658\/revisions\/3665"}],"wp:attachment":[{"href":"https:\/\/blog.plataformatec.com.br\/wp-json\/wp\/v2\/media?parent=3658"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.plataformatec.com.br\/wp-json\/wp\/v2\/categories?post=3658"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.plataformatec.com.br\/wp-json\/wp\/v2\/tags?post=3658"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}