Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

PO-242 : added esc_url for security fix #22

Merged
merged 2 commits into from
Nov 12, 2024
Merged

PO-242 : added esc_url for security fix #22

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
d53d018
PO-242 : added esc_url for security fix
abdulwahidsharief Nov 12, 2024
11c3f52
updated stable tag
abdulwahidsharief Nov 12, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions includes/rzp-payment-buttons.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -88,16 +88,16 @@ protected function get_views()

//All Buttons
$class = ($current === 'all' ? ' class="current"' :'');
$all_url = remove_query_arg('status');
$all_url = esc_url(remove_query_arg('status'));
$views['all'] = "<a href='{$all_url}' {$class} >All</a>";

//Recovered link
$foo_url = add_query_arg('status','active');
$foo_url = esc_url(add_query_arg('status','active'));
$class = ($current === 'active' ? ' class="current"' :'');
$views['status'] = "<a href='{$foo_url}' {$class} >Enabled</a>";

//Abandon
$bar_url = add_query_arg('status','inactive');
$bar_url = esc_url(add_query_arg('status','inactive'));
$class = ($current === 'inactive' ? ' class="current"' :'');
$views['disabled'] = "<a href='{$bar_url}' {$class} >Disabled</a>";

Expand Down
2 changes: 1 addition & 1 deletion razorpay-payment-buttons.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
* Plugin Name: Razorpay Payment Button for Elementor
* Plugin URI: https://github.com/razorpay/payment-button-elementor-plugin
* Description: Razorpay Payment Button for Elementor
* Version: 1.2.5
* Version: 1.2.6
* Author: Razorpay
* Author URI: https://razorpay.com
*/
Expand Down
7 changes: 5 additions & 2 deletions readme.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
=== Razorpay Payment Button Elementor Plugin ===
Contributors: razorpay
Tags: Payment gateway, Donate button, UPI/credit/debit card, Payment plugin, India
Tested up to: 6.0
Stable tag: 1.2.5
Tested up to: 6.6
Stable tag: 1.2.6
License: GPLv2 or later
License URI: http://www.gnu.org/licenses/gpl-2.0.html

Expand Down Expand Up @@ -96,6 +96,9 @@ Connect your WordPress website with your Razorpay account and you're all ready t

== Changelog ==

= 1.2.6 =
* Added security enhancements

= 1.2.5 =
* Fix fatal error: Cannot use isset() on the result of an expression
* Fixed 'constant already defined' error in sdk
Expand Down
26 changes: 13 additions & 13 deletions templates/razorpay-button-view-templates.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@ function razorpay_view_button()
{
wp_die("This page consist some request parameters to view response");
}
$pagenum = $_REQUEST['paged'];
$pagenum = sanitize_text_field($_REQUEST['paged']); // nosemgrep
$previous_page_url = admin_url('admin.php?page=razorpay_button_elementor&paged='.$pagenum);
$button_detail = $this->fetch_button_detail(sanitize_text_field($_REQUEST['btn']));

Expand All @@ -36,36 +36,36 @@ function razorpay_view_button()
<a href="'.$previous_page_url.'">
<span class="dashicons rzp-dashicons dashicons-arrow-left-alt"></span> Button List
</a>
<span class="dashicons rzp-dashicons dashicons-arrow-right-alt2"></span>'.$button_detail['title'].'
<span class="dashicons rzp-dashicons dashicons-arrow-right-alt2"></span>'. esc_html($button_detail['title']) . '
</div>
<div class="container rzp-container">
<div class="row panel-heading">
<div class="text">'.$button_detail['title'].'</div>
<div class="text">' . esc_html($button_detail['title']) . '</div>
</div>
<div class="row panel-body">
<div class="col-md-5 panel-body-left">
<div class="row">
<div class="col-sm-4 panel-label">Button ID</div>
<div class="col-sm-8 panel-value">'.$button_detail["id"].'</div>
<div class="col-sm-8 panel-value">' . esc_html($button_detail["id"]) . '</div>
</div>
<div class="row">
<div class="col-sm-4 panel-label">Button Status</div>
<div class="col-sm-8 panel-value">
<span class="status-label">'.$button_detail['status'].'</span>
<button onclick="'.$show.'" class="status-button">'.$button_detail['btn_pointer_status'].'</button>
<span class="status-label">' . esc_html$button_detail['status']) . '</span>
<button onclick="'.$show.'" class="status-button">' . esc_html($button_detail['btn_pointer_status']) . '</button>
</div>
</div>
<div class="row">
<div class="col-sm-4 panel-label">Total Quantity Sold</div>
<div class="col-sm-8 panel-value">'.$button_detail['total_item_sold'].'</div>
<div class="col-sm-8 panel-value">' . htmlentities($button_detail['total_item_sold']) . '</div>
</div>
<div class="row">
<div class="col-sm-4 panel-label">Total revenue</div>
<div class="col-sm-8 panel-value"><span class="rzp-currency">₹ </span>'.$button_detail['total_revenue'].'</div>
<div class="col-sm-8 panel-value"><span class="rzp-currency">₹ </span>' . esc_html($button_detail['total_revenue']) . '</div>
</div>
<div class="row">
<div class="col-sm-4 panel-label">Created on</div>
<div class="col-sm-8 panel-value">'.$button_detail['created_at'].'</div>
<div class="col-sm-8 panel-value">' . esc_html($button_detail['created_at']) . '</div>
</div>
</div>
<div class="col-md-7">'.$button_detail['html_content_item'].'</div>
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Echoing user input risks cross-site scripting vulnerability. You should use htmlentities() when showing data to users.

View Dataflow Graph 
flowchart LR
    classDef invis fill:white, stroke: none
    classDef default fill:#e7f5ff, color:#1c7fd6, stroke: none

    subgraph File0["<b>templates/razorpay-button-view-templates.php</b>"]
        direction LR
        %% Source

        subgraph Source
            direction LR

            v0["<a href=https://github.com/razorpay/payment-button-elementor-plugin/blob/d53d01809c8fef793483f449b55ea821b34613a5/templates/razorpay-button-view-templates.php#L28 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 28] $_REQUEST</a>"]
        end
        %% Intermediate

        subgraph Traces0[Traces]
            direction TB

            v2["<a href=https://github.com/razorpay/payment-button-elementor-plugin/blob/d53d01809c8fef793483f449b55ea821b34613a5/templates/razorpay-button-view-templates.php#L28 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 28] $pagenum</a>"]

            v3["<a href=https://github.com/razorpay/payment-button-elementor-plugin/blob/d53d01809c8fef793483f449b55ea821b34613a5/templates/razorpay-button-view-templates.php#L29 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 29] $previous_page_url</a>"]
        end
            v2 --> v3
        %% Sink

        subgraph Sink
            direction LR

            v1["<a href=https://github.com/razorpay/payment-button-elementor-plugin/blob/d53d01809c8fef793483f449b55ea821b34613a5/templates/razorpay-button-view-templates.php#L34 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 34] echo &apos;&lt;div class=&quot;wrap&quot;&gt;<br>            &lt;div class=&quot;content-header&quot;&gt;<br>                &lt;a href=&quot;&apos;.$previous_page_url.&apos;&quot;&gt;<br>                    &lt;span class=&quot;dashicons rzp-dashicons dashicons-arrow-left-alt&quot;&gt;&lt;/span&gt; Button List<br>                &lt;/a&gt;<br>                &lt;span class=&quot;dashicons rzp-dashicons dashicons-arrow-right-alt2&quot;&gt;&lt;/span&gt;&apos;. esc_html($button_detail[&apos;title&apos;]) . &apos;<br>            &lt;/div&gt;<br>            &lt;div class=&quot;container rzp-container&quot;&gt;<br>                &lt;div class=&quot;row panel-heading&quot;&gt;<br>                    &lt;div class=&quot;text&quot;&gt;&apos; . esc_html($button_detail[&apos;title&apos;]) . &apos;&lt;/div&gt;<br>                &lt;/div&gt;<br>                &lt;div class=&quot;row panel-body&quot;&gt;<br>                    &lt;div class=&quot;col-md-5 panel-body-left&quot;&gt;<br>                        &lt;div class=&quot;row&quot;&gt;<br>                            &lt;div class=&quot;col-sm-4 panel-label&quot;&gt;Button ID&lt;/div&gt;<br>                            &lt;div class=&quot;col-sm-8 panel-value&quot;&gt;&apos; . esc_html($button_detail[&quot;id&quot;]) . &apos;&lt;/div&gt;<br>                        &lt;/div&gt;<br>                        &lt;div class=&quot;row&quot;&gt;<br>                            &lt;div class=&quot;col-sm-4 panel-label&quot;&gt;Button Status&lt;/div&gt;<br>                            &lt;div class=&quot;col-sm-8 panel-value&quot;&gt;<br>                                &lt;span class=&quot;status-label&quot;&gt;&apos; . esc_html$button_detail[&apos;status&apos;]) . &apos;&lt;/span&gt;<br>                                &lt;button onclick=&quot;&apos;.$show.&apos;&quot; class=&quot;status-button&quot;&gt;&apos; . esc_html($button_detail[&apos;btn_pointer_status&apos;]) . &apos;&lt;/button&gt;<br>                            &lt;/div&gt;<br>                        &lt;/div&gt;<br>                        &lt;div class=&quot;row&quot;&gt;<br>                            &lt;div class=&quot;col-sm-4 panel-label&quot;&gt;Total Quantity Sold&lt;/div&gt;<br>                            &lt;div class=&quot;col-sm-8 panel-value&quot;&gt;&apos; . htmlentities($button_detail[&apos;total_item_sold&apos;]) . &apos;&lt;/div&gt;<br>                        &lt;/div&gt;<br>                        &lt;div class=&quot;row&quot;&gt;<br>                            &lt;div class=&quot;col-sm-4 panel-label&quot;&gt;Total revenue&lt;/div&gt;<br>                            &lt;div class=&quot;col-sm-8 panel-value&quot;&gt;&lt;span class=&quot;rzp-currency&quot;&gt;₹ &lt;/span&gt;&apos; . esc_html($button_detail[&apos;total_revenue&apos;]) . &apos;&lt;/div&gt;<br>                        &lt;/div&gt;<br>                        &lt;div class=&quot;row&quot;&gt;<br>                            &lt;div class=&quot;col-sm-4 panel-label&quot;&gt;Created on&lt;/div&gt;<br>                            &lt;div class=&quot;col-sm-8 panel-value&quot;&gt;&apos; . esc_html($button_detail[&apos;created_at&apos;]) . &apos;&lt;/div&gt;<br>                        &lt;/div&gt;<br>                    &lt;/div&gt;<br>                    &lt;div class=&quot;col-md-7&quot;&gt;&apos;.$button_detail[&apos;html_content_item&apos;].&apos;&lt;/div&gt;<br>                &lt;/div&gt;          <br>            &lt;/div&gt;<br>                  <br>        &lt;/div&gt;&apos;;</a>"]
        end
    end
    %% Class Assignment
    Source:::invis
    Sink:::invis

    Traces0:::invis
    File0:::invis

    %% Connections

    Source --> Traces0
    Traces0 --> Sink
Loading
# ```suggestion echo htmlentities('
Button List '. esc_html($button_detail['title']) . '
' . esc_html($button_detail['title']) . '
Button ID
' . esc_html($button_detail["id"]) . '
Button Status
' . esc_html$button_detail['status']) . ' ' . esc_html($button_detail['btn_pointer_status']) . '
Total Quantity Sold
' . htmlentities($button_detail['total_item_sold']) . '
Total revenue
₹ ' . esc_html($button_detail['total_revenue']) . '
Created on
' . esc_html($button_detail['created_at']) . '
'.$button_detail['html_content_item'].'
            </div>');

<sub>⚪️ This finding does not block your pull request.
</sub><br/><sub>
<a href="https://semgrep.dev/docs/ignoring-files-folders-code">Ignore this finding</a> from <a href="https://semgrep.dev/playground/r/RGTKGXN/php.lang.security.injection.echoed-request.echoed-request?utm_campaign=finding_notification&utm_medium=review_comment&utm_source=github&utm_content=rule">echoed-request</a>.
</sub>


<!--

🤫 WELCOME TO SECRET SEMGREP! 🤫
This information is for debugging purposes and does not appear in rendered PR comments.

Finding id: 105423697
Syntactic id: 830568d0e859b0a7a0e329f71809bbfc
Start line: 34,9
End line: 75,17
Index: 0
-->

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Semgrep Assistant thinks this might be safe to ignore. The user input from $_request['paged'] is sanitized using sanitize_text_field before being used, which mitigates the risk of cross-site scripting. the finding is not exploitable in this context.

AI-generated comment; review carefully.
Leave a 👍 reaction to ignore the finding. Reacting with 👍 or 👎 also provides feedback to improve Assistant's future comments.

Expand All @@ -78,16 +78,16 @@ function razorpay_view_button()
<form class="modal-content" action="'.esc_url( admin_url('admin-post.php') ).'" method="POST">
<div class="container">
<div class="modal-header">
<h3 class="modal-title">'.$button_detail["modal_title_content"].'</h3>
<h3 class="modal-title">' . esc_html($button_detail["modal_title_content"]) . '</h3>
</div>
<div class="modal-body">
<div class="text-semi-muted">
<p>'.$button_detail["modal_body_content"].'</p>
<p>' . esc_html($button_detail["modal_body_content"]) . '</p>
</div>
<div class="Modal__actions">
<button type="button" onclick="'.$hide.'" class="btn btn-default">No, don`t!</button>
<button type="submit" onclick="'.$hide.'" name="btn_action" value="'.$button_detail['btn_pointer_status'].'" class="btn btn-primary">Yes, '.$button_detail['btn_pointer_status'].'</button>
<input type="hidden" name="btn_id" value="'.$button_detail['id'].'">
<button type="submit" onclick="'.$hide.'" name="btn_action" value="' . esc_html($button_detail['btn_pointer_status']) . '" class="btn btn-primary">Yes, ' . esc_html($button_detail['btn_pointer_status']) . '</button>
<input type="hidden" name="btn_id" value="' . esc_html($button_detail['id']) . '">
<input type="hidden" name="paged" value="'.$pagenum.'">
<input type="hidden" name="action" value="rzp_btn_elementor_action">
</div>
Expand Down