groove/Part-DB-server
1
0
Fork 0
mirror of https://github.com/Part-DB/Part-DB-server.git synced 2026-06-17 08:01:32 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fixed stored XSS vulnerability in BOM Validation Service

Browse source
This commit is contained in:
Jan Böhmer 2026-06-14 11:55:16 +02:00
parent 8421636b1c
commit c9dd27712c
2 changed files with 11 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

10
src/Services/ImportExportSystem/BOMValidationService.php
View file

@ -29,13 +29,13 @@ use Symfony\Contracts\Translation\TranslatorInterface;
/**
* Service for validating BOM import data with comprehensive validation rules
* and user-friendly error messages.
* and user-friendly error messages. The results are not HTML safe, and must be escaped before display!
*/
class BOMValidationService
readonly class BOMValidationService
{
public function __construct(
private readonly EntityManagerInterface $entityManager,
private readonly TranslatorInterface $translator
private EntityManagerInterface $entityManager,
private TranslatorInterface $translator
) {
}
@ -473,4 +473,4 @@ class BOMValidationService
: 0,
];
}
}
}

12
templates/projects/_bom_validation_results.html.twig
View file

@ -68,7 +68,7 @@
<p class="mb-2">{% trans %}project.bom_import.validation.errors.description{% endtrans %}</p>
<ul class="mb-0">
{% for error in validation_result.errors %}
<li>{{ error|raw }}</li>
<li>{{ error }}</li>
{% endfor %}
</ul>
</div>
@ -80,7 +80,7 @@
<p class="mb-2">{% trans %}project.bom_import.validation.warnings.description{% endtrans %}</p>
<ul class="mb-0">
{% for warning in validation_result.warnings %}
<li>{{ warning|raw }}</li>
<li>{{ warning }}</li>
{% endfor %}
</ul>
</div>
@ -91,7 +91,7 @@
<h4><i class="fa-solid fa-info-circle fa-fw"></i> {% trans %}project.bom_import.validation.info.title{% endtrans %}</h4>
<ul class="mb-0">
{% for info in validation_result.info %}
<li>{{ info|raw }}</li>
<li>{{ info }}</li>
{% endfor %}
</ul>
</div>
@ -139,21 +139,21 @@
{% if line_result.errors is not empty %}
<div class="text-danger">
{% for error in line_result.errors %}
<div><i class="fa-solid fa-exclamation-triangle fa-fw"></i> {{ error|raw }}</div>
<div><i class="fa-solid fa-exclamation-triangle fa-fw"></i> {{ error }}</div>
{% endfor %}
</div>
{% endif %}
{% if line_result.warnings is not empty %}
<div class="text-warning">
{% for warning in line_result.warnings %}
<div><i class="fa-solid fa-exclamation-circle fa-fw"></i> {{ warning|raw }}</div>
<div><i class="fa-solid fa-exclamation-circle fa-fw"></i> {{ warning }}</div>
{% endfor %}
</div>
{% endif %}
{% if line_result.info is not empty %}
<div class="text-info">
{% for info in line_result.info %}
<div><i class="fa-solid fa-info-circle fa-fw"></i> {{ info|raw }}</div>
<div><i class="fa-solid fa-info-circle fa-fw"></i> {{ info }}</div>
{% endfor %}
</div>
{% endif %}