diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000000000..2b06199e5f95a --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,10 @@ +# Reporting Security Issues + +Magento values the contributions of the security research community, and we look forward to working with you to minimize risk to Magento merchants. + +## Where should I report security issues? + +We strongly encourage you to report all security issues privately via our [bug bounty program](https://hackerone.com/magento). Please provide us with relevant technical details and repro steps to expedite our investigation. If you prefer not to use HackerOne, email us directly at `psirt@adobe.com` with details and repro steps. + +## Learning More About Security +To learn more about securing a Magento store, please visit the [Security Center](https://magento.com/security). diff --git a/app/code/Magento/AdminNotification/Model/Feed.php b/app/code/Magento/AdminNotification/Model/Feed.php index d3b0b8501c864..05b6922673e49 100644 --- a/app/code/Magento/AdminNotification/Model/Feed.php +++ b/app/code/Magento/AdminNotification/Model/Feed.php @@ -25,6 +25,11 @@ class Feed extends \Magento\Framework\Model\AbstractModel const XML_LAST_UPDATE_PATH = 'system/adminnotification/last_update'; + /** + * @var \Magento\Framework\Escaper + */ + private $escaper; + /** * Feed url * @@ -77,6 +82,7 @@ class Feed extends \Magento\Framework\Model\AbstractModel * @param \Magento\Framework\Model\ResourceModel\AbstractResource $resource * @param \Magento\Framework\Data\Collection\AbstractDb $resourceCollection * @param array $data + * @param \Magento\Framework\Escaper|null $escaper * @SuppressWarnings(PHPMD.ExcessiveParameterList) */ public function __construct( @@ -90,21 +96,26 @@ public function __construct( \Magento\Framework\UrlInterface $urlBuilder, \Magento\Framework\Model\ResourceModel\AbstractResource $resource = null, \Magento\Framework\Data\Collection\AbstractDb $resourceCollection = null, - array $data = [] + array $data = [], + \Magento\Framework\Escaper $escaper = null ) { parent::__construct($context, $registry, $resource, $resourceCollection, $data); - $this->_backendConfig = $backendConfig; - $this->_inboxFactory = $inboxFactory; - $this->curlFactory = $curlFactory; + $this->_backendConfig = $backendConfig; + $this->_inboxFactory = $inboxFactory; + $this->curlFactory = $curlFactory; $this->_deploymentConfig = $deploymentConfig; - $this->productMetadata = $productMetadata; - $this->urlBuilder = $urlBuilder; + $this->productMetadata = $productMetadata; + $this->urlBuilder = $urlBuilder; + $this->escaper = $escaper ?? \Magento\Framework\App\ObjectManager::getInstance()->get( + \Magento\Framework\Escaper::class + ); } /** * Init model * * @return void + * phpcs:disable Magento2.CodeAnalysis.EmptyBlock */ protected function _construct() { @@ -252,6 +263,6 @@ public function getFeedXml() */ private function escapeString(\SimpleXMLElement $data) { - return htmlspecialchars((string)$data); + return $this->escaper->escapeHtml((string)$data); } } diff --git a/app/code/Magento/AdminNotification/view/adminhtml/templates/notification/window.phtml b/app/code/Magento/AdminNotification/view/adminhtml/templates/notification/window.phtml index 3f79e803ccca2..b4f19bda36cbf 100644 --- a/app/code/Magento/AdminNotification/view/adminhtml/templates/notification/window.phtml +++ b/app/code/Magento/AdminNotification/view/adminhtml/templates/notification/window.phtml @@ -4,10 +4,6 @@ * See COPYING.txt for license details. */ -// @codingStandardsIgnoreFile - -?> -getHeaderText() ?>" + "title": "escapeHtmlAttr($block->getHeaderText()) ?>" } }'>
  • - getNoticeMessageText() ?>
    - getReadDetailsText() ?> + escapeHtml($block->getNoticeMessageText()) ?>
    + + escapeHtml($block->getReadDetailsText()) ?> +
  • diff --git a/app/code/Magento/AdminNotification/view/adminhtml/templates/system/messages.phtml b/app/code/Magento/AdminNotification/view/adminhtml/templates/system/messages.phtml index 01d6fdcb29571..22512b9055f95 100644 --- a/app/code/Magento/AdminNotification/view/adminhtml/templates/system/messages.phtml +++ b/app/code/Magento/AdminNotification/view/adminhtml/templates/system/messages.phtml @@ -4,41 +4,41 @@ * See COPYING.txt for license details. */ -// @codingStandardsIgnoreFile - +/** @var $block \Magento\AdminNotification\Block\System\Messages */ ?> - getLastCritical();?> -
    +
    - +
    • - getText() ?> + escapeHtml($lastCritical->getText()) ?>
    - + escapeHtml(__('System Messages:')) ?> - getCriticalCount()): ?> + getCriticalCount()) : ?> - + - getMajorCount()): ?> + getMajorCount()) : ?> - +
    diff --git a/app/code/Magento/AdminNotification/view/adminhtml/templates/system/messages/popup.phtml b/app/code/Magento/AdminNotification/view/adminhtml/templates/system/messages/popup.phtml index 37548e1599004..494e60865623b 100644 --- a/app/code/Magento/AdminNotification/view/adminhtml/templates/system/messages/popup.phtml +++ b/app/code/Magento/AdminNotification/view/adminhtml/templates/system/messages/popup.phtml @@ -4,16 +4,15 @@ * See COPYING.txt for license details. */ -// @codingStandardsIgnoreFile - +/** @var $block \Magento\AdminNotification\Block\System\Messages\UnreadMessagePopup */ ?> - -