CVE-2023-4145: Fix Xss in the segment name (#490) · pimcore/customer-data-framework@72f45dd

Expand Up

@@ -19,6 +19,7 @@

use CustomerManagementFrameworkBundle\Model\CustomerSegmentInterface;

use Pimcore\Model\DataObject\ClassDefinition;

use Pimcore\Model\DataObject\ClassDefinition\Data;

use Pimcore\Security\SecurityHelper;

use Symfony\Contracts\Translation\TranslatorInterface;

class DefaultViewFormatter implements ViewFormatterInterface

Expand Down Expand Up

@@ -176,7 +177,7 @@ public function getLocale()

*/

protected function formatSegmentValue(CustomerSegmentInterface $segment)

{

return sprintf('<span class="label label-default">%s</span>’, $segment->getName());

return sprintf('<span class="label label-default">%s</span>’, SecurityHelper::convertHtmlSpecialChars($segment->getName()));

}

protected function getLanguageFromLocale($locale)

Expand Down