Helix Ultimate SanitizeEmbed Audio Issue - Question | JoomShaper
Back to the questions

Helix Ultimate SanitizeEmbed Audio Issue

A

Alvaro

Helix Framework 1 week ago

Hello. The sanitizer isn't working properly. When testing the video, it might seem like it is, but in reality, the video layout builds the video embed based on $video_src and not from embed code, which is mostly iframes.

The problem arises when you try to display an audio embed. The sanitizer removes all the code because the filter is set to 1, 1, which blacklists the $tags and $attrs lists. Therefore, all iframe embeds are completely removed, but other potentially dangerous tags for stored XSS can pass in their place.

The proposed solution is to change the configuration to [], [], 0, 0, 0. Setting the fifth parameter to 0 allows iframes to be displayed. If it's not assigned, it's set to 1 (the default value), which removes all iframes because Joomla filters iframes by default. To fix the exposure caused by setting the fifth parameter to 0, you can clean it with a regular expression: $filter->clean($html, 'html');.

We've run our own tests, and if you'd like, we can provide details privately, as this isn't related to a layout but rather to the Helix helper.

Regards

0
2 Answers
Order by
Oldest Newest Votes
Atick Eashrak Shuvo
Atick Eashrak Shuvo
Accepted Answer
Support Agent 1 week ago #232265

Hello Alvaro,

We apologize for the inconvenience.

I have forwarded the reported issue to our development team for further investigation and resolution. The fix will be included in an upcoming update.

We sincerely appreciate your patience and understanding while our team works on this.

Best regards

0
A
Alvaro
Accepted Answer
2 days ago #232669

Hi there. The new version of Helix doesn't have this patched. I took the time to explain, but I don't think it was clear. I'll try again, but without giving details of how those who attacked my client used it. With sanitizeEmbed method, two things happen:

  1. It doesn't display any real embeds because it uses InputFilter::getInstance( ['iframe', 'audio', 'video', 'source', 'a', 'img'], ['src', 'href', 'type', 'controls', 'width', 'height', 'allow', 'allowfullscreen', 'frameborder', 'alt', 'class', 'style'], 1, 1); And this, simply put, is what filtering iframe, audio, video, source, a, img does: with 1, 1, you're telling it that the list you're passing is a black list.

  2. Since you're telling the filter that the list is blacklisted, everything else script, svg, form, etc. full of JavaScript, is still passed through and printed to the client.

In short, it removes the actual embed code but passes through any malicious code that might be present. The problem was, and still is, the sanitizeEmbed method in helper.php.

Regards

0