Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

PO-243 changing escaping for attributes #24

Merged
merged 5 commits into from
Nov 14, 2024
Merged

PO-243 changing escaping for attributes #24

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
215bc9b
PO-243 changing escaping for attributes
abdulwahidsharief Nov 14, 2024
4843f32
added escaping
yashgit891 Nov 14, 2024
1e5a518
reverting esc_html for html_content_item
abdulwahidsharief Nov 14, 2024
d42eb12
added esc_url for elementorSVG
abdulwahidsharief Nov 14, 2024
4dd3bb8
version bump 1.2.7
abdulwahidsharief Nov 14, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion razorpay-payment-buttons.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
* Plugin Name: Razorpay Payment Button for Elementor
* Plugin URI: https://github.com/razorpay/payment-button-elementor-plugin
* Description: Razorpay Payment Button for Elementor
* Version: 1.2.6
* Version: 1.2.7
* Author: Razorpay
* Author URI: https://razorpay.com
*/
Expand Down
5 changes: 4 additions & 1 deletion readme.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
Contributors: razorpay
Tags: Payment gateway, Donate button, UPI/credit/debit card, Payment plugin, India
Tested up to: 6.6
Stable tag: 1.2.6
Stable tag: 1.2.7
License: GPLv2 or later
License URI: http://www.gnu.org/licenses/gpl-2.0.html

Expand Down Expand Up @@ -96,6 +96,9 @@ Connect your WordPress website with your Razorpay account and you're all ready t

== Changelog ==

= 1.2.7 =
* Added security enhancements

= 1.2.6 =
* Added security enhancements

Expand Down
16 changes: 7 additions & 9 deletions templates/razorpay-button-view-templates.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,11 +29,9 @@ function razorpay_view_button()
$previous_page_url = admin_url('admin.php?page=razorpay_button_elementor&paged='.$pagenum);
$button_detail = $this->fetch_button_detail(sanitize_text_field($_REQUEST['btn']));

$show = "jQuery('.overlay').show()";
$hide = "jQuery('.overlay').hide()";
echo '<div class="wrap">
<div class="content-header">
<a href="'.$previous_page_url.'">
<a href="' . esc_url($previous_page_url) . '">
<span class="dashicons rzp-dashicons dashicons-arrow-left-alt"></span> Button List
</a>
<span class="dashicons rzp-dashicons dashicons-arrow-right-alt2"></span>'. esc_html($button_detail['title']) . '
Expand All @@ -52,12 +50,12 @@ function razorpay_view_button()
<div class="col-sm-4 panel-label">Button Status</div>
<div class="col-sm-8 panel-value">
<span class="status-label">' . esc_html($button_detail['status']) . '</span>
<button onclick="'.$show.'" class="status-button">' . esc_html($button_detail['btn_pointer_status']) . '</button>
<button onclick="jQuery(\'.overlay\').show()" class="status-button">' . esc_html($button_detail['btn_pointer_status']) . '</button>
</div>
</div>
<div class="row">
Copy link

@semgrep-code-razorpay semgrep-code-razorpay bot Nov 14, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Echoing user input risks cross-site scripting vulnerability. You should use htmlentities() when showing data to users.

🧹 Fixed in commit 4843f32 🧹

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Semgrep Assistant thinks this might be safe to ignore. The user input is sanitized using 'sanitize_text_field' and 'esc_url', which are appropriate sanitization functions for preventing xss in this context. therefore, the risk of cross-site scripting is mitigated.

AI-generated comment; review carefully.
Leave a 👍 reaction to ignore the finding. Reacting with 👍 or 👎 also provides feedback to improve Assistant's future comments.

<div class="col-sm-4 panel-label">Total Quantity Sold</div>
<div class="col-sm-8 panel-value">' . htmlentities($button_detail['total_item_sold']) . '</div>
<div class="col-sm-8 panel-value">' . esc_html($button_detail['total_item_sold']) . '</div>
</div>
<div class="row">
<div class="col-sm-4 panel-label">Total revenue</div>
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Echoing user input risks cross-site scripting vulnerability. You should use htmlentities() when showing data to users.

View Dataflow Graph 
flowchart LR
    classDef invis fill:white, stroke: none
    classDef default fill:#e7f5ff, color:#1c7fd6, stroke: none

    subgraph File0["<b>templates/razorpay-button-view-templates.php</b>"]
        direction LR
        %% Source

        subgraph Source
            direction LR

            v0["<a href=https://github.com/razorpay/payment-button-elementor-plugin/blob/1e5a518adbfbe46a517cc8662d101952419fcf42/templates/razorpay-button-view-templates.php#L28 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 28] $_REQUEST</a>"]
        end
        %% Intermediate

        subgraph Traces0[Traces]
            direction TB

            v2["<a href=https://github.com/razorpay/payment-button-elementor-plugin/blob/1e5a518adbfbe46a517cc8662d101952419fcf42/templates/razorpay-button-view-templates.php#L28 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 28] $pagenum</a>"]

            v3["<a href=https://github.com/razorpay/payment-button-elementor-plugin/blob/1e5a518adbfbe46a517cc8662d101952419fcf42/templates/razorpay-button-view-templates.php#L29 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 29] $previous_page_url</a>"]
        end
            v2 --> v3
        %% Sink

        subgraph Sink
            direction LR

            v1["<a href=https://github.com/razorpay/payment-button-elementor-plugin/blob/1e5a518adbfbe46a517cc8662d101952419fcf42/templates/razorpay-button-view-templates.php#L32 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 32] echo &apos;&lt;div class=&quot;wrap&quot;&gt;<br>            &lt;div class=&quot;content-header&quot;&gt;<br>                &lt;a href=&quot;&apos; . esc_url($previous_page_url) . &apos;&quot;&gt;<br>                    &lt;span class=&quot;dashicons rzp-dashicons dashicons-arrow-left-alt&quot;&gt;&lt;/span&gt; Button List<br>                &lt;/a&gt;<br>                &lt;span class=&quot;dashicons rzp-dashicons dashicons-arrow-right-alt2&quot;&gt;&lt;/span&gt;&apos;. esc_html($button_detail[&apos;title&apos;]) . &apos;<br>            &lt;/div&gt;<br>            &lt;div class=&quot;container rzp-container&quot;&gt;<br>                &lt;div class=&quot;row panel-heading&quot;&gt;<br>                    &lt;div class=&quot;text&quot;&gt;&apos; . esc_html($button_detail[&apos;title&apos;]) . &apos;&lt;/div&gt;<br>                &lt;/div&gt;<br>                &lt;div class=&quot;row panel-body&quot;&gt;<br>                    &lt;div class=&quot;col-md-5 panel-body-left&quot;&gt;<br>                        &lt;div class=&quot;row&quot;&gt;<br>                            &lt;div class=&quot;col-sm-4 panel-label&quot;&gt;Button ID&lt;/div&gt;<br>                            &lt;div class=&quot;col-sm-8 panel-value&quot;&gt;&apos; . esc_html($button_detail[&quot;id&quot;]) . &apos;&lt;/div&gt;<br>                        &lt;/div&gt;<br>                        &lt;div class=&quot;row&quot;&gt;<br>                            &lt;div class=&quot;col-sm-4 panel-label&quot;&gt;Button Status&lt;/div&gt;<br>                            &lt;div class=&quot;col-sm-8 panel-value&quot;&gt;<br>                                &lt;span class=&quot;status-label&quot;&gt;&apos; . esc_html($button_detail[&apos;status&apos;]) . &apos;&lt;/span&gt;<br>                                &lt;button onclick=&quot;jQuery(\&apos;.overlay\&apos;).show()&quot; class=&quot;status-button&quot;&gt;&apos; . esc_html($button_detail[&apos;btn_pointer_status&apos;]) . &apos;&lt;/button&gt;<br>                            &lt;/div&gt;<br>                        &lt;/div&gt;<br>                        &lt;div class=&quot;row&quot;&gt;<br>                            &lt;div class=&quot;col-sm-4 panel-label&quot;&gt;Total Quantity Sold&lt;/div&gt;<br>                            &lt;div class=&quot;col-sm-8 panel-value&quot;&gt;&apos; . esc_html($button_detail[&apos;total_item_sold&apos;]) . &apos;&lt;/div&gt;<br>                        &lt;/div&gt;<br>                        &lt;div class=&quot;row&quot;&gt;<br>                            &lt;div class=&quot;col-sm-4 panel-label&quot;&gt;Total revenue&lt;/div&gt;<br>                            &lt;div class=&quot;col-sm-8 panel-value&quot;&gt;&lt;span class=&quot;rzp-currency&quot;&gt;₹ &lt;/span&gt;&apos; . esc_html($button_detail[&apos;total_revenue&apos;]) . &apos;&lt;/div&gt;<br>                        &lt;/div&gt;<br>                        &lt;div class=&quot;row&quot;&gt;<br>                            &lt;div class=&quot;col-sm-4 panel-label&quot;&gt;Created on&lt;/div&gt;<br>                            &lt;div class=&quot;col-sm-8 panel-value&quot;&gt;&apos; . esc_html($button_detail[&apos;created_at&apos;]) . &apos;&lt;/div&gt;<br>                        &lt;/div&gt;<br>                    &lt;/div&gt;<br>                    &lt;div class=&quot;col-md-7&quot;&gt;&apos;.$button_detail[&apos;html_content_item&apos;].&apos;&lt;/div&gt;<br>                &lt;/div&gt;          <br>            &lt;/div&gt;<br>                  <br>        &lt;/div&gt;&apos;;</a>"]
        end
    end
    %% Class Assignment
    Source:::invis
    Sink:::invis

    Traces0:::invis
    File0:::invis

    %% Connections

    Source --> Traces0
    Traces0 --> Sink
Loading
# ```suggestion echo htmlentities('
Button List '. esc_html($button_detail['title']) . '
' . esc_html($button_detail['title']) . '
Button ID
' . esc_html($button_detail["id"]) . '
Button Status
' . esc_html($button_detail['status']) . ' ' . esc_html($button_detail['btn_pointer_status']) . '
Total Quantity Sold
' . esc_html($button_detail['total_item_sold']) . '
Total revenue
₹ ' . esc_html($button_detail['total_revenue']) . '
Created on
' . esc_html($button_detail['created_at']) . '
'.$button_detail['html_content_item'].'
            </div>');

<sub>⚪️ This finding does not block your pull request.
</sub><br/><sub>
<a href="https://semgrep.dev/docs/ignoring-files-folders-code">Ignore this finding</a> from <a href="https://semgrep.dev/playground/r/RGTKGXN/php.lang.security.injection.echoed-request.echoed-request?utm_campaign=finding_notification&utm_medium=review_comment&utm_source=github&utm_content=rule">echoed-request</a>.
</sub>


<!--

🤫 WELCOME TO SECRET SEMGREP! 🤫
This information is for debugging purposes and does not appear in rendered PR comments.

Finding id: 106164589
Syntactic id: 810ad2058996f77fa9a7c1b99c59bf60
Start line: 32,9
End line: 73,17
Index: 0
-->

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Semgrep Assistant thinks this might be safe to ignore. The user input is sanitized using 'sanitize_text_field' and 'esc_url', which are appropriate sanitization functions for this context, mitigating the risk of cross-site scripting.

AI-generated comment; review carefully.
Leave a 👍 reaction to ignore the finding. Reacting with 👍 or 👎 also provides feedback to improve Assistant's future comments.

Expand Down Expand Up @@ -85,10 +83,10 @@ function razorpay_view_button()
<p>' . esc_html($button_detail["modal_body_content"]) . '</p>
</div>
<div class="Modal__actions">
<button type="button" onclick="'.$hide.'" class="btn btn-default">No, don`t!</button>
<button type="submit" onclick="'.$hide.'" name="btn_action" value="' . esc_html($button_detail['btn_pointer_status']) . '" class="btn btn-primary">Yes, ' . esc_html($button_detail['btn_pointer_status']) . '</button>
<input type="hidden" name="btn_id" value="' . esc_html($button_detail['id']) . '">
<input type="hidden" name="paged" value="'.$pagenum.'">
<button type="button" onclick="jQuery(\'.overlay\').hide()" class="btn btn-default">No, don`t!</button>
<button type="submit" onclick="jQuery(\'.overlay\').hide()" name="btn_action" value="' . esc_attr($button_detail['btn_pointer_status']) . '" class="btn btn-primary">Yes, ' . esc_html($button_detail['btn_pointer_status']) . '</button>
<input type="hidden" name="btn_id" value="' . esc_attr($button_detail['id']) . '">
<input type="hidden" name="paged" value="' . esc_attr($pagenum) . '">
<input type="hidden" name="action" value="rzp_btn_elementor_action">
</div>
</div>
Expand Down
2 changes: 1 addition & 1 deletion widget/RazorpayElementsButton.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -194,7 +194,7 @@ protected function content_template()
<# if ( settings.select_button === 'select') { #>
<div class="elementor-counter-title">Please select payment button.</div>
<# } else { #>
<img src=" <?php echo plugin_dir_url(__FILE__).'../public/image/elementorSVG.svg';?>" alt="Razorpay" >
<img src=" <?php echo esc_url(plugin_dir_url(__FILE__).'../public/image/elementorSVG.svg');?>" alt="Razorpay" >
<# } #>
<?php
}
Expand Down