Fix missing variable escaping in the JS tracking code generator #8109
Conversation
The tracking code generator was not escaping quotes in string values (e.g. tracking custom variables).
| ' _paq.push(["setCustomVariable", %d, %s, %s, "visit"]);%s', | ||
| $index++, | ||
| json_encode($visitorCustomVariable[0]), | ||
| json_encode($visitorCustomVariable[1]), |
There was a problem hiding this comment.
Is it possible for $visitorCustomVariable to have non-string elements? If so, perhaps they should be casted to strings.
EDIT: Same for page custom variables.
EDIT2: I think using json_encode is ok, actually, though it might result in incorrect tracking code in some cases. Though those cases may never occur in production.
|
The JS tracking code in jsTrackingGenerator.js uses I see that TrackingCodeGenerator is used when rendering the _displayJavascriptCode template, but the template outputs the tracker code via I think after the TODO that's in the code is dealt w/, and the above XSS is verified to be a non-issue, this can be merged. |
|
Created new issue here: #8123 |
Fix missing variable escaping in the JS tracking code generator, use json_encode to output proper JavaScript string values for tracking code options.
The tracking code generator was not escaping quotes in string values (e.g. tracking custom variables).
Was reported in #8035
Also the automatic HTML entities encoding for API parameters was messing things up (yet another #4231 win), I added a temporary fix to remove later.
Reviewers: please give another look for XSS issues.