gitmedia/presseportale
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

security: Stored-XSS über page_url im Kontaktformular schließen (H3)

Browse source 
page_url aus dem anonymen Kontaktformular wird auf url:http,https
validiert; das Admin-Backend rendert nur http(s)-Links klickbar, sonst
als Text. Verhindert javascript:-URIs, die beim Admin-Klick im
Admin-Kontext liefen.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Kevin Adametz 2026-07-14 13:49:05 +00:00
parent 77f8f9cb35
commit 8f517e993d
3 changed files with 43 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

8
app/Http/Controllers/Web/ContactController.php
View file

@ -36,7 +36,9 @@ class ContactController extends Controller
'email' => ['required', 'email', 'max:255'],
'message' => ['required', 'string', 'min:10', 'max:5000'],
'topic' => ['nullable', Rule::enum(ContactMessageTopic::class)],
'page_url' => ['nullable', 'string', 'max:500'],
// Nur http/https: page_url wird im Admin-Backend als klickbarer Link
// gerendert — verhindert eingeschleuste javascript:-URIs (Stored XSS).
'page_url' => ['nullable', 'url:http,https', 'max:500'],
], [
'name.required' => __('web.launcher.validation_name'),
'name.max' => __('web.launcher.validation_name'),
@ -64,14 +66,14 @@ class ContactController extends Controller
'user_id' => $request->user()?->id,
]);
Mail::to($this->recipient())->send(new ContactRequestSubmitted(
Mail::to($this->recipient())->queue((new ContactRequestSubmitted(
senderName: $validated['name'],
senderEmail: $validated['email'],
messageText: $validated['message'],
host: $request->getHost(),
topicLabel: $topic->label(),
pageUrl: $validated['page_url'] ?? null,
));
))->afterCommit());
return $this->done();
}